aws / aws/aws-cdk

aws_fsx: resource sg-xxx has a dependent object

Open
#31,521 4 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-fsx bug effort/small p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
71

Description

### Describe the bug

I have created a Fsx Lustre cluster.
I can't delete it due to a dependence between security group and the ENI of Fsx Lustre

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

Able to delete the stack without going to the AWS Console

### Current Behavior

destroying... [6/7]
2:43:14 PM | DELETE_FAILED | AWS::EC2::SecurityGroup | lustresg6B5C6047
resource sg-05712a293a30dce52 has a dependent object (Service: Ec2, Status Code: 400, Request ID: 62184a39-ecfc-4eb7-8ba2-6c96f113b959)

```
❌ batch-ffmpeg-storage-stack: destroy failed Error: The stack named batch-ffmpeg-storage-stack is in a failed state. You may need to delete it from the AWS console : DELETE_FAILED (The following resource(s) failed to delete: [lustresg6B5C6047]. ): resource sg-xxxx has a dependent object (Service: Ec2, Status Code: 400, Request ID: xxx)
at destroyStack (/Users/xxxx/.local/share/mise/installs/node/18.18.2/lib/node_modules/aws-cdk/lib/index.js:463:2157)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async CdkToolkit.destroy (/Users/xxxx/.local/share/mise/installs/node/18.18.2/lib/node_modules/aws-cdk/lib/index.js:466:208221)
at async exec4 (/Users/xxxx/.local/share/mise/installs/node/18.18.2/lib/node_modules/aws-cdk/lib/index.js:521:54490)

The stack named batch-ffmpeg-storage-stack is in a failed state. You may need to delete it from the AWS console : DELETE_FAILED (The following resource(s) failed to delete: [lustresgxxx]. ): resource sg-xxxx has a dependent object (Service: Ec2, Status Code: 400, Request ID: xxx-ecfc-4eb7-8ba2-6c96f113b959)
task: Failed to run task "cdk:destroy": exit status 1
```

### Reproduction Steps

```python
lustre_subnet = self.vpc.select_subnets(
subnet_type=ec2.SubnetType.PRIVATE_ISOLATED
).subnets[0]

lustre_sg = ec2.SecurityGroup(
self,
"LustreSecurityGroup",
vpc=self.vpc,
description="Security group for FSx Lustre",
allow_all_outbound=True,
)
lustre_sg.add_ingress_rule(
peer=ec2.Peer.ipv4(self.vpc.vpc_cidr_block),
connection=ec2.Port.tcp(988),
description="FSx Lustre client port",
)

lustre_fs = fsx.LustreFileSystem(
self,
"LustreFileSystem",
vpc=self.vpc,
vpc_subnet=lustre_subnet,
security_group=lustre_sg,
storage_capacity_gib=self.node.try_get_context(
"batch-ffmpeg:lustre-fs:storage_capacity_gi_b"
),
lustre_configuration=fsx.LustreConfiguration(
deployment_type=fsx.LustreDeploymentType.SCRATCH_2,
export_path=self.s3_bucket.s3_url_for_object(),
import_path=self.s3_bucket.s3_url_for_object(),
auto_import_policy=fsx.LustreAutoImportPolicy.NEW_CHANGED_DELETED,
),
)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.159.1 (build c66f4e3)

### Framework Version

_No response_

### Node.js Version

v18.18.2

### OS

Macos

### Language

Python

### Language Version

3.12.6

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Python stack using ec2.SecurityGroup and fsx.LustreFileSystem, then investigate the FSx Lustre security-group and ENI deletion dependency reported during cdk destroy. Done means the stack and its security group can be deleted without manual AWS Console cleanup.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.