aws / aws/aws-cdk

aws_iam: CfnOIDCProviderProps property `thumbprintList` should be optional, instead required

Open
#31,050 6 comments 4 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam bug effort/medium needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When trying to create a `CfnOIDCProvider` the `CfnOIDCProviderProps` interface is insisting that the object have a `thumbprintList` property despite it being described as optional in the documentation and the source code comments.

### Expected Behavior

The `thumbprintList` property should either be optional or the documentation should be changed

### Current Behavior

If you attempt to *not* include the property then you get the following error:
```
TSError: ⨯ Unable to compile TypeScript:
src/eks-stack.ts:152:81 - error TS2345: Argument of type 'XXX' is not assignable to parameter of type 'CfnOIDCProviderProps'.
Property 'thumbprintList' is missing in type XXX but required in type 'CfnOIDCProviderProps'.
```

If you add the property and assign an empty array as its value then you get the following error during stack deployment:
```
k8clustertest-eks: creating CloudFormation changeset...
11:07:06 AM | CREATE_FAILED | AWS::IAM::OIDCProvider | k8ClusterTestia
moidcProvider
Resource handler returned message: "Thumbprint list must contain at least one
entry. (Service: Iam, Status Code: 400, Request ID: 6b1f1768-5936-41f0-b5ae-86-
)" (RequestToken: 82cbfe67-0e29-b496-d036-, HandlerError
Code: InvalidRequest)
```

### Reproduction Steps

```
new iam.CfnOIDCProvider(this, 'oidcProvider', {
url: kubernetes.attrOpenIdConnectIssuerUrl
})
```

### Possible Solution

Change the CfnOIDCProviderProps interface as follows:
```
export interface CfnOIDCProviderProps {
readonly thumbprintList?: Array;
// ....
}
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.151

### Framework Version

_No response_

### Node.js Version

22.5.1

### OS

MacOS Sonoma 14.6

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the CfnOIDCProviderProps definition and its source comments, then compare the thumbprintList requirement with the CfnOIDCProvider reproduction in the issue. Done means the TypeScript type accepts an omitted thumbprintList and the documented optional behavior is consistent with the resulting CloudFormation resource contract.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.