aws_cdk.aws_sqs.Queue: CDK version upgrade causes grant_consume_messages to not generate IAM policy
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
When upgrading to the latest CDK version `2.179.0` there are several stack with IAM policies being dropped.
The policies are generated from using the `grant_consume_message` method for `aws_sqs.Queue` ([link](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_sqs/Queue.html#aws_cdk.aws_sqs.Queue.grant_consume_messages))
An example of the application code is
```
class SalesforceEventsStack(cdk.Stack):
....
main_queue = aws_sqs.Queue(
scope=self,
id=queue_name,
queue_name=f'{queue_name}-{self._honor_env.value}',
encryption=aws_sqs.QueueEncryption.KMS,
encryption_master_key=self._encryption_key,
dead_letter_queue=aws_sqs.DeadLetterQueue(
queue=dead_letter, max_receive_count=3
),
)
# sqs_worker_stack is a separate stack that owns IAM user sqs_worker_user
main_queue.grant_consume_messages(sqs_worker_stack.sqs_worker_user)
```
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
2.141.0
### Expected Behavior
`grant_consume_messages` would continue to generate IAM policies for the associated queue and grantable construct
### Current Behavior
`grant_consume_messages` is not creating IAM policies for the IAM user / grantable construct
### Reproduction Steps
Generated diff using CDK version `2.179.0`
```
cdk diff -e SalesforceEventsStack-dev
....
Stack SalesforceEventsStack-dev
IAM Statement Changes
┌───┬──────────────────────────────────────────────────────────┬────────┬──────────────────────────────────────────────────────────┬────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼──────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${salesforce-event-receiver.Arn} │ Allow │ sqs:ChangeMessageVisibility │ AWS:arn:aws:iam::xxx:user/sqs-worker.dev │ │
│ │ │ │ sqs:DeleteMessage │ │ │
│ │ │ │ sqs:GetQueueAttributes │ │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:ReceiveMessage │ │ │
│ - │ ${salesforce-event-receiver.Arn} │ Allow │ sqs:GetQueueAttributes │ AWS:arn:aws:iam::xxx:user/external-webhook.dev │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:SendMessage │ │ │
├───┼──────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${salesforce-event-sender.Arn} │ Allow │ sqs:ChangeMessageVisibility │ AWS:arn:aws:iam::xxx:user/sqs-worker.dev │ │
│ │ │ │ sqs:DeleteMessage │ │ │
│ │ │ │ sqs:GetQueueAttributes │ │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:ReceiveMessage │ │ │
│ - │ ${salesforce-event-sender.Arn} │ Allow │ sqs:GetQueueAttributes │ AWS:arn:aws:iam::xxx:user/external-api.dev │ │
│ │ │ │ sqs:GetQueueUrl │ │ │
│ │ │ │ sqs:SendMessage │ │ │
└───┴──────────────────────────────────────────────────────────┴────────┴──────────────────────────────────────────────────────────┴────────────────────────────────────────────────────────────┴───────────┘
Resources
[-] AWS::SQS::QueuePolicy salesforce-event-sender/Policy salesforceeventsenderPolicy03108016 destroy
[-] AWS::SQS::QueuePolicy salesforce-event-receiver/Policy salesforceeventreceiverPolicy8466F361 destroy
✨ Number of stacks with differences: 1
# Confirm version of CDK
pip show aws-cdk-lib
Name: aws-cdk-lib
Version: 2.179.0
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.179.0 (build b867f19)
### Framework Version
_No response_
### Node.js Version
v18.15.0
### OS
macos Sequoia version 15.2
### Language
Python
### Language Version
Python 3.10.6
### Other information
_No response_
Contributor guide
Research direction
Reproduce the reported cdk diff with aws-cdk-lib 2.179.0 and compare it with 2.141.0, focusing on aws_sqs.Queue.grant_consume_messages and the IAM user in the separate stack. Trace how the queue policy and grantable construct are handled; done means the expected SQS IAM statements and QueuePolicy resources remain present after the upgrade.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100