aws / aws/aws-cdk

aws-cdk-lib/aws-s3: Removing object lock from s3 bucket leads to InternalFailure due to getObjectLockEnabled() is null

Open
#34,709 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I have cdk code to create a S3 bucket with ObjectLock optionally turned on, depending on a property in the respective stage.
When I deploy the stack with ObjectLock turned off and then change it to on this change can be deployed flawlessly (and ObjectLock then indeed is turned on on the bucket).

However, when I then try to disable ObjectLock again I get:
`7:23:45 AM | UPDATE_FAILED | AWS::S3::Bucket | foobucketB1767E36
Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)

❌ mystack failed: _ToolkitError: The stack named mystack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)`

CDK code looks like:
` this.bucketprops = {
removalPolicy: props.removalPolicy,
versioned: true,
lifecycleRules: [
{
//expiration: cdk.Duration.days(1),
transitions: [
{
storageClass: s3.StorageClass.GLACIER_INSTANT_RETRIEVAL,
transitionAfter: cdk.Duration.days(1),
}
]
}
],
};

if (props.objectLockDefaultRetention !== undefined) {
this.bucketprops = Object.assign(this.bucketprops, {objectLockDefaultRetention: s3.ObjectLockRetention.governance(cdk.Duration.days(props.objectLockDefaultRetention))});
}

this.inbucket = new s3.Bucket(this, 'foobucket', this.bucketprops);`

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy leads to object lock turned off on bucket.

### Current Behavior

When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy leads to
`7:23:45 AM | UPDATE_FAILED | AWS::S3::Bucket | foobucketB1767E36
Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)

❌ mystack failed: _ToolkitError: The stack named mystack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)`

### Reproduction Steps

When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy.

### Possible Solution

"software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled() is null" and "InternalFailure" sounds like a bug to me - should be fixed.
If there is some error/mistake/misunderstanding on my side, please bear with me - this are my first steps in cdk... ;-)

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.200.1

### AWS CDK CLI version

2.1017.1 (build 60506e5)

### Node.js Version

v22.15.0

### OS

github devcontainer Ubuntu 20.04.6 LTS

### Language

TypeScript

### Language Version

TypeScript (5.8.3)

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the AWS::S3::Bucket update from an object-lock retention value to undefined, then trace how the S3 bucket configuration reaches the resource handler and getObjectLockEnabled(). Done means the update completes without InternalFailure and object lock is disabled as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.