aws-backup: Parameter names with incorrect casing for AWS::Backup::Framework L1 construct in Python
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Can not deploy AWS Backup Audit Manager Framework using the L1 construct
The issue is that the property name for the sub type `FrameworkControl.ControlScope.ComplianceResourceTypes` is synthesized as complianceResourceTypes (lowercase c) and CFN will fail validation.
### Expected Behavior
L1 construct for `AWS::Backup::Framework.FrameworkControl.ControlScope.ComplianceResourceTypes` would synth with the correct casing
``` json
"DefaultFramework": {
"Type": "AWS::Backup::Framework",
"Properties": {
"FrameworkControls": [
{
"ControlInputParameters": [],
"ControlName": "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
"ControlScope": {
"ComplianceResourceTypes": [ // <-- Expect Upper Case "C"
"RDS"
]
}
}
]
}
}
```
- [ ]
### Current Behavior
L1 construct for `AWS::Backup::Framework.FrameworkControl.ControlScope.ComplianceResourceTypes` synth produces the following with a lowercase "c"
``` json
"DefaultFramework": {
"Type": "AWS::Backup::Framework",
"Properties": {
"FrameworkControls": [
{
"ControlInputParameters": [],
"ControlName": "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
"ControlScope": {
"complianceResourceTypes": [ // <-- Produces lower case "c"
"RDS"
]
}
}
]
}
}
```
``` shell
# cdk deploy
...
The stack named backup-audit-sandpit failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Properties validation failed for resource Framework with message:
#/FrameworkControls/1/ControlScope: extraneous key [complianceResourceTypes] is not permitted
```
### Reproduction Steps
``` python
from aws_cdk import (
aws_backup as backup,
Stack,
App,
)
class BackupAudit(Stack):
def __init__(self, app: App, id: str, **kwargs) -> None:
super().__init__(app, id, **kwargs)
default_framework = backup.CfnFramework(
self,
"DefaultFramework",
framework_controls=[
backup.CfnFramework.FrameworkControlProperty(
control_name="BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
control_input_parameters=[],
control_scope=backup.CfnFramework.ControlScopeProperty(
compliance_resource_types=[
"RDS",
"Aurora",
"EFS",
"EC2",
"EBS",
"DynamoDB",
"FSx",
],
),
),
],
)
app = App()
BackupAudit(app, "backup-audit-sandpit")
app.synth()
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.127.0 (build 6c90efc)
### Framework Version
aws-cdk-lib 2.128.0
### Node.js Version
v20.11.0
### OS
Ubuntu 22.04 (WSL)
### Language
Python
### Language Version
Python 3.10.12
### Other information
Passing a raw dictionary into `control_scope` with the correct key values will produce the correct CFN output
The issue only seems to occur when you use the `backup.CfnFramework.ControlScopeProperty()` class as an input
Contributor guide
Research direction
Start with the Python entry point backup.CfnFramework.ControlScopeProperty and reproduce the synthesized output using the example in the issue. Trace how compliance_resource_types becomes complianceResourceTypes; done when the synthesized AWS::Backup::Framework uses ComplianceResourceTypes and the reported deployment validation error is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100