cdk import fails for AWS::Bedrock::KnowledgeBase due to StorageConfiguration catch-22
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
## Description
`cdk import` for `AWS::Bedrock::KnowledgeBase` resources is impossible due to a catch-22 with the `StorageConfiguration` property.
## Reproduction Steps
1. Create a Bedrock Knowledge Base with S3 Vectors storage via the AWS Console
2. Define the same resource in CDK using `CfnKnowledgeBase` (L1)
3. Run `cdk import` to adopt the existing resource
## Expected Behavior
The existing Knowledge Base should be imported into the CloudFormation stack successfully, since the template values match the actual resource state.
## Actual Behavior
**If `StorageConfiguration` is included in the template:**
```
Resource handler returned message: "You cannot modify the storage configuration of the
Vector knowledge base once created." (HandlerErrorCode: InvalidRequest)
```
**If `StorageConfiguration` is removed from the template:**
```
Resource handler returned message: "You must provide a storage configuration if you
create a VECTOR knowledge base." (HandlerErrorCode: InvalidRequest)
```
This creates an impossible situation — the property cannot be included or excluded.
## Root Cause
The `StorageConfiguration` property is marked as `createOnlyProperties` in the CloudFormation resource schema. However, the Bedrock `UpdateKnowledgeBase` API unconditionally rejects any request that includes `StorageConfiguration`, even if the values are identical to the current state.
During CloudFormation import, the resource handler appears to call the Update API with the template's `StorageConfiguration`, which triggers the rejection. This is a bug in the CloudFormation resource handler — it should recognize that the value is unchanged during an import operation.
The same underlying API limitation was encountered and resolved in the Terraform AWS provider: https://github.com/hashicorp/terraform-provider-aws/issues/38022
## Additional Context
- We also encountered `RoleArn` and `Tags` being rejected during import (resolved by upgrading CDK Bootstrap from v25 to v30+)
- `AWS::S3Vectors::VectorBucket` and `AWS::S3Vectors::Index` import successfully
- We tried hardcoding the ARN values (instead of `Fn::GetAtt`) to ensure exact match — same error
- CDK version: 2.1118.0
- aws-cdk-lib version: 2.248.0
## Environment
- CDK CLI Version: 2.1118.0
- aws-cdk-lib Version: 2.248.0
- Node.js Version: v22
- OS: macOS
- Language: TypeScript
Contributor guide
Research direction
Start by reproducing the failure with `cdk import` for a `CfnKnowledgeBase` using `StorageConfiguration`, then inspect the CloudFormation resource handler's `UpdateKnowledgeBase` behavior. No repository file or test is named; done means the existing Bedrock Knowledge Base imports successfully with matching storage configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100