aws-cdk-lib/aws-s3: Removing object lock from s3 bucket leads to InternalFailure due to getObjectLockEnabled() is null
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I have cdk code to create a S3 bucket with ObjectLock optionally turned on, depending on a property in the respective stage.
When I deploy the stack with ObjectLock turned off and then change it to on this change can be deployed flawlessly (and ObjectLock then indeed is turned on on the bucket).
However, when I then try to disable ObjectLock again I get:
`7:23:45 AM | UPDATE_FAILED | AWS::S3::Bucket | foobucketB1767E36
Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)
❌ mystack failed: _ToolkitError: The stack named mystack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)`
CDK code looks like:
` this.bucketprops = {
removalPolicy: props.removalPolicy,
versioned: true,
lifecycleRules: [
{
//expiration: cdk.Duration.days(1),
transitions: [
{
storageClass: s3.StorageClass.GLACIER_INSTANT_RETRIEVAL,
transitionAfter: cdk.Duration.days(1),
}
]
}
],
};
if (props.objectLockDefaultRetention !== undefined) {
this.bucketprops = Object.assign(this.bucketprops, {objectLockDefaultRetention: s3.ObjectLockRetention.governance(cdk.Duration.days(props.objectLockDefaultRetention))});
}
this.inbucket = new s3.Bucket(this, 'foobucket', this.bucketprops);`
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy leads to object lock turned off on bucket.
### Current Behavior
When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy leads to
`7:23:45 AM | UPDATE_FAILED | AWS::S3::Bucket | foobucketB1767E36
Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)
❌ mystack failed: _ToolkitError: The stack named mystack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null" (RequestToken: 2b263817-blah-bla-foo-bar, HandlerErrorCode: InternalFailure)`
### Reproduction Steps
When stack deployed and props.objectLockDefaultRetention is some integer, change that prop to undefined and redeploy.
### Possible Solution
"software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled() is null" and "InternalFailure" sounds like a bug to me - should be fixed.
If there is some error/mistake/misunderstanding on my side, please bear with me - this are my first steps in cdk... ;-)
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
aws-cdk-lib@2.200.1
### AWS CDK CLI version
2.1017.1 (build 60506e5)
### Node.js Version
v22.15.0
### OS
github devcontainer Ubuntu 20.04.6 LTS
### Language
TypeScript
### Language Version
TypeScript (5.8.3)
### Other information
_No response_
Contributor guide
Research direction
Start by reproducing the AWS::S3::Bucket update from an object-lock retention value to undefined, then trace how the S3 bucket configuration reaches the resource handler and getObjectLockEnabled(). Done means the update completes without InternalFailure and object lock is disabled as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100