aws / aws/aws-cdk

CfnInclude: fails to parse/load a CloudFormation template which is acceptable to CloudFormation CreateStack

Open
#29,642 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/cloudformation-include @aws-cdk/core bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

CloudFormation template which specifies a string-concatenation for `AssumeRolePolicyDocument` attribute in `AWS::IAM::Role` resource is **NOT** accepted by `CfnInclude()`. `cdk synth` fails with a exception:

```
CfnSynthesisError: Resolution error: Supplied properties not correct for "CfnRoleProps"
assumeRolePolicyDocument: "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n}" should be an 'object'.
```

See various permutations for the `AssumeRoelPolicyDocument` attribute in the `iam-role.yaml` file attached to this ticket.
[iam-role.yaml.txt](https://github.com/aws/aws-cdk/files/14795414/iam-role.yaml.txt)

### Expected Behavior

`CfnInclude()` should accept CloudFormation YAML files that are accepted by CloudFormation `CreateStack`.

### Current Behavior

`cdk synth` fails with an exception.

### Reproduction Steps

Create YAML file as described.
Run `cdk synth` using a CDK application which uses `CfnInclude()` to include the YAML file.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.134.0 (build 265d769)

### Framework Version

_No response_

### Node.js Version

v20.7.0

### OS

MacOS

### Language

TypeScript

### Language Version

TypeScript (5.1.6)

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with CfnInclude and the attached iam-role.yaml.txt, then run the cdk synth reproduction to trace how the string-concatenated AssumeRolePolicyDocument is parsed and validated. Done means CfnInclude accepts the template form that CloudFormation CreateStack accepts and cdk synth completes without the CfnSynthesisError.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, yaml
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.