aws / aws/aws-cdk

cdk import fails for AWS::Bedrock::KnowledgeBase due to StorageConfiguration catch-22

Open
#37,555 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/bedrock blocked effort/medium needs-cfn p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

## Description

`cdk import` for `AWS::Bedrock::KnowledgeBase` resources is impossible due to a catch-22 with the `StorageConfiguration` property.

## Reproduction Steps

1. Create a Bedrock Knowledge Base with S3 Vectors storage via the AWS Console
2. Define the same resource in CDK using `CfnKnowledgeBase` (L1)
3. Run `cdk import` to adopt the existing resource

## Expected Behavior

The existing Knowledge Base should be imported into the CloudFormation stack successfully, since the template values match the actual resource state.

## Actual Behavior

**If `StorageConfiguration` is included in the template:**

```
Resource handler returned message: "You cannot modify the storage configuration of the
Vector knowledge base once created." (HandlerErrorCode: InvalidRequest)
```

**If `StorageConfiguration` is removed from the template:**

```
Resource handler returned message: "You must provide a storage configuration if you
create a VECTOR knowledge base." (HandlerErrorCode: InvalidRequest)
```

This creates an impossible situation — the property cannot be included or excluded.

## Root Cause

The `StorageConfiguration` property is marked as `createOnlyProperties` in the CloudFormation resource schema. However, the Bedrock `UpdateKnowledgeBase` API unconditionally rejects any request that includes `StorageConfiguration`, even if the values are identical to the current state.

During CloudFormation import, the resource handler appears to call the Update API with the template's `StorageConfiguration`, which triggers the rejection. This is a bug in the CloudFormation resource handler — it should recognize that the value is unchanged during an import operation.

The same underlying API limitation was encountered and resolved in the Terraform AWS provider: https://github.com/hashicorp/terraform-provider-aws/issues/38022

## Additional Context

- We also encountered `RoleArn` and `Tags` being rejected during import (resolved by upgrading CDK Bootstrap from v25 to v30+)
- `AWS::S3Vectors::VectorBucket` and `AWS::S3Vectors::Index` import successfully
- We tried hardcoding the ARN values (instead of `Fn::GetAtt`) to ensure exact match — same error
- CDK version: 2.1118.0
- aws-cdk-lib version: 2.248.0

## Environment

- CDK CLI Version: 2.1118.0
- aws-cdk-lib Version: 2.248.0
- Node.js Version: v22
- OS: macOS
- Language: TypeScript

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with `cdk import` for a `CfnKnowledgeBase` using `StorageConfiguration`, then inspect the CloudFormation resource handler's `UpdateKnowledgeBase` behavior. No repository file or test is named; done means the existing Bedrock Knowledge Base imports successfully with matching storage configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.