secretsmanager.RotationSchedule(): breaks cdk import
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Secrets Manager RotationSchedule is causing all resources in the stack to be reported as "unsupported resource type" during cdk import.
### Expected Behavior
Supported resources are able to be imported during cdk import
```
cdk import
ExampleStack
ExampleStack/ExampleVpc/Resource (AWS::EC2::VPC): enter VpcId (empty to skip):
```
### Current Behavior
```
cdk import
ExampleStack
ExampleStack/ExampleVpc/Resource: unsupported resource type AWS::EC2::VPC, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/EIP: unsupported resource type AWS::EC2::EIP, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/NATGateway: unsupported resource type AWS::EC2::NatGateway, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/EIP: unsupported resource type AWS::EC2::EIP, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/NATGateway: unsupported resource type AWS::EC2::NatGateway, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/IGW: unsupported resource type AWS::EC2::InternetGateway, skipping import.
ExampleStack/ExampleVpc/VPCGW: unsupported resource type AWS::EC2::VPCGatewayAttachment, skipping import.
ExampleStack/ExampleVpc/RestrictDefaultSecurityGroupCustomResource/Default: unsupported resource type Custom::VpcRestrictDefaultSG, skipping import.
ExampleStack/Custom::VpcRestrictDefaultSGCustomResourceProvider/Role: unsupported resource type AWS::IAM::Role, skipping import.
ExampleStack/Custom::VpcRestrictDefaultSGCustomResourceProvider/Handler: unsupported resource type AWS::Lambda::Function, skipping import.
ExampleStack/ExampleSecret/Resource: unsupported resource type AWS::SecretsManager::Secret, skipping import.
ExampleStack/ExampleSecret/Policy/Resource: unsupported resource type AWS::SecretsManager::ResourcePolicy, skipping import.
ExampleStack/ExampleRotationSchedule/Resource: unsupported resource type AWS::SecretsManager::RotationSchedule, skipping import.
No resources selected for import.
```
### Reproduction Steps
```
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
export class ExampleStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const vpc = new ec2.Vpc(this, 'ExampleVpc', {
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
})
const secret = new secretsmanager.Secret(this, 'ExampleSecret', {
secretObjectValue: {
username: cdk.SecretValue.unsafePlainText('appuser'),
database: cdk.SecretValue.unsafePlainText('foo'),
password: cdk.SecretValue.unsafePlainText('default'),
},
})
const rotationSchedule = new secretsmanager.RotationSchedule(this, 'ExampleRotationSchedule', {
secret: secret,
hostedRotation: secretsmanager.HostedRotation.mysqlSingleUser(),
});
}
}
```
### Possible Solution
_No response_
### Additional Information/Context
It looks like this is the line that is causing all stack imports to fail.
`Stack.of(scope).addTransform('AWS::SecretsManager-2020-07-23');`
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts#L309
### CDK CLI Version
2.148.1
### Framework Version
_No response_
### Node.js Version
v20.10.0
### OS
MacOS 14.5
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts around line 309, where the AWS::SecretsManager transform is added, and reproduce the failure with cdk import using the TypeScript example. Trace how that transform affects import resource detection; done means a stack containing RotationSchedule still allows supported resources to be selected for import instead of reporting them as unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100