aws / aws/aws-cdk

aws-stepfunctions-tasks: endpointConfigName Token not resolved in create endpoint task

Open
#22,635 1 comment 0 reactions 1 assignee Claimed by @kaizencc View on GitHub
@aws-cdk/aws-stepfunctions-tasks bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

CDK doesn't resolve endpoint configuration name in create endpoint task when endpointConfigName is coming from another CDK resource.

Looks like that toLowerCase is causing the trouble.

https://github.com/aws/aws-cdk/blob/v1.178.0/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker/create-endpoint.ts#L86

### Expected Behavior

```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sagemaker:createEndpoint",
"Resource": [
"arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/sagemakerendpointconfig-s39vugh0gkoj",
"arn:aws:sagemaker:us-east-1:1234567890:endpoint/endpoint"
],
"Effect": "Allow"
},
{
"Action": "sagemaker:ListTags",
"Resource": "*",
"Effect": "Allow"
}
]
}
```
### Current Behavior
```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sagemaker:createEndpoint",
"Resource": [
"arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/${token[token.264]}",
"arn:aws:sagemaker:us-east-1:1234567890:endpoint/endpoint"
],
"Effect": "Allow"
},
{
"Action": "sagemaker:ListTags",
"Resource": "*",
"Effect": "Allow"
}
]
}
```
### Reproduction Steps

1. Define endpointcofig and step function:

```
const sagemakerEndpointConfig = new sagemaker.CfnEndpointConfig(this, 'sagemakerEndpointConfig', {
productionVariants: [{
initialVariantWeight: 1,
modelName: model.attrModelName,
variantName: 'default',
initialInstanceCount: 1,
instanceType: 'ml.c4.4xlarge',
}],
});

const taskCreateEndpoint = new tasks.SageMakerCreateEndpoint(this, 'taskCreateEndpoint', {
endpointName: 'endpointblabla',
endpointConfigName: sagemakerEndpointConfig.attrEndpointConfigName,
});

const stateMachine = new sfn.StateMachine(this, 'stateMachine', {
definition: taskCreateEndpoint,
});
```
2. Invoke the state machine
3. Exception from invocation:
```
User: arn:aws:sts::1234567890:assumed-role/xxx-stateMachineRoleD7DCE394-LS2JK2THJEVN/XSPwMkuMxIVkbakcsGDVCSPhcLwtfitA is not authorized to perform: sagemaker:CreateEndpoint on resource: arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/sagemakerendpointconfig-s39vugh0gkoj because no identity-based policy allows the sagemaker:CreateEndpoint action (Service: AmazonSageMaker; Status Code: 400; Error Code: AccessDeniedException; Request ID: 558f50e2-42bb-4a29-8397-001fe1a38d96; Proxy: null)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.47.0 (build 3528e3d)

### Framework Version

_No response_

### Node.js Version

v18.11.0

### OS

mac

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.