aws / aws/aws-cdk

aws-codestarnotifications: missing dependency on target Topic's TopicPolicy

Open
#29,484 4 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-codestarnotifications bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When deploying a stack with an SNS `Topic` and `NotificationRule` for a CodePipeline, it appears the `NotificationRule` will verify that it is able to send messages to the `Topic` and could fail if the `TopicPolicy` has not been deployed yet.

My `TopicPolicy` and `NotifactionRule` were being deployed simultaneously by CloudFormation and the `NotificationRule` deployment failed with error

> Resource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule"

This seems to be caused by `addTarget` in https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-codestarnotifications/lib/notification-rule.ts not adding a dependency to the Topic's policy.

### Expected Behavior

`NotificationRule` is deployed successfully.

### Current Behavior

A race condition caused the NotificationRule deployment to fail if the TopicPolicy happens to not have been deployed yet.

### Reproduction Steps

Cannot be consistently reproduced.

### Possible Solution

In `addTarget`, for each `NotificationRule` target that is a `Topic` that is created in the same stack, add a dependency on the topic's policy.

Workaround, explicitly add the dependency:
```
const topic = new Topic(...);
const rule = new NotificationRule(..., ..., {
...,
targets: [topic]
});
// 'Policy': https://github.com/aws/aws-cdk/blob/v2.132.1/packages/aws-cdk-lib/aws-sns/lib/topic-base.ts#L135
rule.node.addDependency(topic.node.findChild('Policy'));
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.132.1 (build 9df7dd3)

### Framework Version

_No response_

### Node.js Version

v20.10.0

### OS

Windows 10 Version 22H2

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-codestarnotifications/lib/notification-rule.ts and inspect addTarget, then compare how the Topic's Policy child is exposed in packages/aws-cdk-lib/aws-sns/lib/topic-base.ts. Reproduce the same-stack Topic, TopicPolicy, and NotificationRule scenario, and verify that the synthesized deployment orders the NotificationRule after the policy and succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.