aws / aws/aws-cdk

aws-backup: Parameter names with incorrect casing for AWS::Backup::Framework L1 construct in Python

Open
#29,117 4 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-backup bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Can not deploy AWS Backup Audit Manager Framework using the L1 construct

The issue is that the property name for the sub type `FrameworkControl.ControlScope.ComplianceResourceTypes` is synthesized as complianceResourceTypes (lowercase c) and CFN will fail validation.

### Expected Behavior

L1 construct for `AWS::Backup::Framework.FrameworkControl.ControlScope.ComplianceResourceTypes` would synth with the correct casing

``` json
"DefaultFramework": {
"Type": "AWS::Backup::Framework",
"Properties": {
"FrameworkControls": [
{
"ControlInputParameters": [],
"ControlName": "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
"ControlScope": {
"ComplianceResourceTypes": [ // <-- Expect Upper Case "C"
"RDS"
]
}
}
]
}
}
```

- [ ]

### Current Behavior

L1 construct for `AWS::Backup::Framework.FrameworkControl.ControlScope.ComplianceResourceTypes` synth produces the following with a lowercase "c"

``` json
"DefaultFramework": {
"Type": "AWS::Backup::Framework",
"Properties": {
"FrameworkControls": [
{
"ControlInputParameters": [],
"ControlName": "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
"ControlScope": {
"complianceResourceTypes": [ // <-- Produces lower case "c"
"RDS"
]
}
}
]
}
}
```

``` shell
# cdk deploy

...

The stack named backup-audit-sandpit failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Properties validation failed for resource Framework with message:
#/FrameworkControls/1/ControlScope: extraneous key [complianceResourceTypes] is not permitted
```

### Reproduction Steps

``` python
from aws_cdk import (
aws_backup as backup,
Stack,
App,
)

class BackupAudit(Stack):
def __init__(self, app: App, id: str, **kwargs) -> None:
super().__init__(app, id, **kwargs)

default_framework = backup.CfnFramework(
self,
"DefaultFramework",
framework_controls=[
backup.CfnFramework.FrameworkControlProperty(
control_name="BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
control_input_parameters=[],
control_scope=backup.CfnFramework.ControlScopeProperty(
compliance_resource_types=[
"RDS",
"Aurora",
"EFS",
"EC2",
"EBS",
"DynamoDB",
"FSx",
],
),
),
],
)

app = App()

BackupAudit(app, "backup-audit-sandpit")

app.synth()
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.127.0 (build 6c90efc)

### Framework Version

aws-cdk-lib 2.128.0

### Node.js Version

v20.11.0

### OS

Ubuntu 22.04 (WSL)

### Language

Python

### Language Version

Python 3.10.12

### Other information

Passing a raw dictionary into `control_scope` with the correct key values will produce the correct CFN output

The issue only seems to occur when you use the `backup.CfnFramework.ControlScopeProperty()` class as an input

Contributor guide

Open the contributing guide

Research direction

Start with the Python entry point backup.CfnFramework.ControlScopeProperty and reproduce the synthesized output using the example in the issue. Trace how compliance_resource_types becomes complianceResourceTypes; done when the synthesized AWS::Backup::Framework uses ComplianceResourceTypes and the reported deployment validation error is resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.