aws / aws/aws-cdk

aws_cdk.aws_sqs.Queue: CDK version upgrade causes grant_consume_messages to not generate IAM policy

Open
#33,548 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-sqs bug needs-reproduction p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

When upgrading to the latest CDK version `2.179.0` there are several stack with IAM policies being dropped.

The policies are generated from using the `grant_consume_message` method for `aws_sqs.Queue` ([link](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_sqs/Queue.html#aws_cdk.aws_sqs.Queue.grant_consume_messages))

An example of the application code is
```
class SalesforceEventsStack(cdk.Stack):
....
main_queue = aws_sqs.Queue(
scope=self,
id=queue_name,
queue_name=f'{queue_name}-{self._honor_env.value}',
encryption=aws_sqs.QueueEncryption.KMS,
encryption_master_key=self._encryption_key,
dead_letter_queue=aws_sqs.DeadLetterQueue(
queue=dead_letter, max_receive_count=3
),
)
# sqs_worker_stack is a separate stack that owns IAM user sqs_worker_user
main_queue.grant_consume_messages(sqs_worker_stack.sqs_worker_user)
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

2.141.0

### Expected Behavior

`grant_consume_messages` would continue to generate IAM policies for the associated queue and grantable construct

### Current Behavior

`grant_consume_messages` is not creating IAM policies for the IAM user / grantable construct

### Reproduction Steps

Generated diff using CDK version `2.179.0`
```
cdk diff -e SalesforceEventsStack-dev
....
Stack SalesforceEventsStack-dev
IAM Statement Changes
┌───┬──────────────────────────────────────────────────────────┬────────┬──────────────────────────────────────────────────────────┬────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼──────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${salesforce-event-receiver.Arn} │ Allow │ sqs:ChangeMessageVisibility │ AWS:arn:aws:iam::xxx:user/sqs-worker.dev │ │
│ │ │ │ sqs:DeleteMessage │ │ │
│ │ │ │ sqs:GetQueueAttributes │ │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:ReceiveMessage │ │ │
│ - │ ${salesforce-event-receiver.Arn} │ Allow │ sqs:GetQueueAttributes │ AWS:arn:aws:iam::xxx:user/external-webhook.dev │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:SendMessage │ │ │
├───┼──────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${salesforce-event-sender.Arn} │ Allow │ sqs:ChangeMessageVisibility │ AWS:arn:aws:iam::xxx:user/sqs-worker.dev │ │
│ │ │ │ sqs:DeleteMessage │ │ │
│ │ │ │ sqs:GetQueueAttributes │ │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:ReceiveMessage │ │ │
│ - │ ${salesforce-event-sender.Arn} │ Allow │ sqs:GetQueueAttributes │ AWS:arn:aws:iam::xxx:user/external-api.dev │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:SendMessage │ │ │
└───┴──────────────────────────────────────────────────────────┴────────┴──────────────────────────────────────────────────────────┴────────────────────────────────────────────────────────────┴───────────┘

Resources
[-] AWS::SQS::QueuePolicy salesforce-event-sender/Policy salesforceeventsenderPolicy03108016 destroy
[-] AWS::SQS::QueuePolicy salesforce-event-receiver/Policy salesforceeventreceiverPolicy8466F361 destroy

✨ Number of stacks with differences: 1

# Confirm version of CDK
pip show aws-cdk-lib
Name: aws-cdk-lib
Version: 2.179.0

```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.179.0 (build b867f19)

### Framework Version

_No response_

### Node.js Version

v18.15.0

### OS

macos Sequoia version 15.2

### Language

Python

### Language Version

Python 3.10.6

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the reported cdk diff with aws-cdk-lib 2.179.0 and compare it with 2.141.0, focusing on aws_sqs.Queue.grant_consume_messages and the IAM user in the separate stack. Trace how the queue policy and grantable construct are handled; done means the expected SQS IAM statements and QueuePolicy resources remain present after the upgrade.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.