aws / aws/aws-cdk

secretsmanager.RotationSchedule(): breaks cdk import

Open
#30,854 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager bug cli effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Secrets Manager RotationSchedule is causing all resources in the stack to be reported as "unsupported resource type" during cdk import.

### Expected Behavior

Supported resources are able to be imported during cdk import
```
cdk import
ExampleStack
ExampleStack/ExampleVpc/Resource (AWS::EC2::VPC): enter VpcId (empty to skip):
```

### Current Behavior

```
cdk import
ExampleStack
ExampleStack/ExampleVpc/Resource: unsupported resource type AWS::EC2::VPC, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/EIP: unsupported resource type AWS::EC2::EIP, skipping import.
ExampleStack/ExampleVpc/PublicSubnet1/NATGateway: unsupported resource type AWS::EC2::NatGateway, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/EIP: unsupported resource type AWS::EC2::EIP, skipping import.
ExampleStack/ExampleVpc/PublicSubnet2/NATGateway: unsupported resource type AWS::EC2::NatGateway, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet1/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/Subnet: unsupported resource type AWS::EC2::Subnet, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/RouteTable: unsupported resource type AWS::EC2::RouteTable, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/RouteTableAssociation: unsupported resource type AWS::EC2::SubnetRouteTableAssociation, skipping import.
ExampleStack/ExampleVpc/PrivateSubnet2/DefaultRoute: unsupported resource type AWS::EC2::Route, skipping import.
ExampleStack/ExampleVpc/IGW: unsupported resource type AWS::EC2::InternetGateway, skipping import.
ExampleStack/ExampleVpc/VPCGW: unsupported resource type AWS::EC2::VPCGatewayAttachment, skipping import.
ExampleStack/ExampleVpc/RestrictDefaultSecurityGroupCustomResource/Default: unsupported resource type Custom::VpcRestrictDefaultSG, skipping import.
ExampleStack/Custom::VpcRestrictDefaultSGCustomResourceProvider/Role: unsupported resource type AWS::IAM::Role, skipping import.
ExampleStack/Custom::VpcRestrictDefaultSGCustomResourceProvider/Handler: unsupported resource type AWS::Lambda::Function, skipping import.
ExampleStack/ExampleSecret/Resource: unsupported resource type AWS::SecretsManager::Secret, skipping import.
ExampleStack/ExampleSecret/Policy/Resource: unsupported resource type AWS::SecretsManager::ResourcePolicy, skipping import.
ExampleStack/ExampleRotationSchedule/Resource: unsupported resource type AWS::SecretsManager::RotationSchedule, skipping import.
No resources selected for import.
```

### Reproduction Steps

```
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';

export class ExampleStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const vpc = new ec2.Vpc(this, 'ExampleVpc', {
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
})

const secret = new secretsmanager.Secret(this, 'ExampleSecret', {
secretObjectValue: {
username: cdk.SecretValue.unsafePlainText('appuser'),
database: cdk.SecretValue.unsafePlainText('foo'),
password: cdk.SecretValue.unsafePlainText('default'),
},
})

const rotationSchedule = new secretsmanager.RotationSchedule(this, 'ExampleRotationSchedule', {
secret: secret,
hostedRotation: secretsmanager.HostedRotation.mysqlSingleUser(),
});
}
}
```

### Possible Solution

_No response_

### Additional Information/Context

It looks like this is the line that is causing all stack imports to fail.
`Stack.of(scope).addTransform('AWS::SecretsManager-2020-07-23');`
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts#L309

### CDK CLI Version

2.148.1

### Framework Version

_No response_

### Node.js Version

v20.10.0

### OS

MacOS 14.5

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts around line 309, where the AWS::SecretsManager transform is added, and reproduce the failure with cdk import using the TypeScript example. Trace how that transform affects import resource detection; done means a stack containing RotationSchedule still allows supported resources to be selected for import instead of reporting them as unsupported.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.