aws / aws/aws-cdk

CfnMapping: Error when deploying template with mapping default value

Open
#28,386 6 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafregional bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When attempting to deploy a stack that was successfully synthesized using the following code:
```
self.add_transform("AWS::LanguageExtensions")

...

ipset_mapping = CfnMapping(
self,
"IpSetMapping",
mapping={
"us-east-1": {
"Beta": "arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
"Preview": "arn:aws:wafv2:us-east-1::regional/ipset/Preview-NatGateway-IPs/db157747-175a-40ae-b780-d2e8cb6af7f4",
"Prod": "arn:aws:wafv2:us-east-1::regional/ipset/Prod-NatGateway-IPs/39b48ae3-d224-4bc3-87cf-c6827ce15d5d",
},
"ca-central-1": {
"Prod": "arn:aws:wafv2:ca-central-1::regional/ipset/Prod-NatGateway-IPs/4523362c-c473-4e8b-8068-cb3a2dadb0bd",
},
"eu-central-1": {
"Prod": "arn:aws:wafv2:eu-central-1::regional/ipset/Prod-NatGateway-IPs/fdb0fdfe-e479-4216-be04-bfafa9cc329b",
},
"ap-southeast-2": {
"Prod": "arn:aws:wafv2:ap-southeast-2::regional/ipset/Prod-NatGateway-IPs/c07a88f7-1b9b-4e1c-97e0-07a4c711631e"
},
},
)

...

ip_set_scope_down_statement = wafv2.CfnWebACL.StatementProperty(
not_statement=wafv2.CfnWebACL.NotStatementProperty(
statement=wafv2.CfnWebACL.StatementProperty(
ip_set_reference_statement=wafv2.CfnWebACL.IPSetReferenceStatementProperty(
arn=ipset_mapping.find_in_map(
Fn.sub("${AWS::Region}"),
environment.value_as_string,
"arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
)
)
)
)
)
```

The synthesized template shows:
```

"Transform": [
"AWS::LanguageExtensions"
],

...

"Mappings": {
"IpSetMapping": {
"us-east-1": {
"Beta": "arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
"Preview": "arn:aws:wafv2:us-east-1::regional/ipset/Preview-NatGateway-IPs/db157747-175a-40ae-b780-d2e8cb6af7f4",
"Prod": "arn:aws:wafv2:us-east-1::regional/ipset/Prod-NatGateway-IPs/39b48ae3-d224-4bc3-87cf-c6827ce15d5d"
},
"ca-central-1": {
"Prod": "arn:aws:wafv2:ca-central-1::regional/ipset/Prod-NatGateway-IPs/4523362c-c473-4e8b-8068-cb3a2dadb0bd"
},
"eu-central-1": {
"Prod": "arn:aws:wafv2:eu-central-1::regional/ipset/Prod-NatGateway-IPs/fdb0fdfe-e479-4216-be04-bfafa9cc329b"
},
"ap-southeast-2": {
"Prod": "arn:aws:wafv2:ap-southeast-2::regional/ipset/Prod-NatGateway-IPs/c07a88f7-1b9b-4e1c-97e0-07a4c711631e"
}
}
},

...

"scopeDownStatement": {
"notStatement": {
"statement": {
"ipSetReferenceStatement": {
"arn": {
"Fn::FindInMap": [
"IpSetMapping",
{
"Fn::Sub": "${AWS::Region}"
},
{
"Ref": "Environment"
},
{
"DefaultValue": "arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45"
}
]
}
}
}
}
}
```

The change set validation/stack deployment fails with `Template error: every Fn::FindInMap object requires three parameters, the map name, map key and the attribute for return value.`

I have also tried adding the map name:

```
ipset_mapping.find_in_map(
"IpSetMapping",
Fn.sub("${AWS::Region}"),
environment.value_as_string,
"arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
)
```

According to the [documentation](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk/CfnMapping.html#aws_cdk.CfnMapping.find_in_map) my code appears to be correct.

### Expected Behavior

The synthesized stack deploys successfully.

### Current Behavior

The change set validation/stack deployment fails with `Template error: every Fn::FindInMap object requires three parameters, the map name, map key and the attribute for return value.`

### Reproduction Steps

Synthesize and attempt to deploy a template using code similar to:

```
ipset_mapping.find_in_map(
Fn.sub("${AWS::Region}"),
environment.value_as_string,
"arn:aws:wafv2:us-east-1::regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.115.0 (build 58027ee)

### Framework Version

_No response_

### Node.js Version

21.4.0

### OS

MacOS

### Language

Python

### Language Version

3.12.0

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the CfnMapping.find_in_map entry point and inspect how the Python call is rendered into the synthesized Fn::FindInMap object. Reproduce the template from the issue and validate it through a change set or deployment, focusing on the extra default-value parameter. Done means the synthesized mapping is accepted and the stack deploys successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.