aws / aws/aws-cdk

[config] Python - generated template is invalid due to lowercase keys in the schema

Open
#8,996 7 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-config bug effort/large p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

Python - generated template is invalid due to lowercase keys in the schema.
`CfnRemediationConfiguration.RemediationParameterValueProperty`, `CfnRemediationConfiguration.StaticValueProperty` and `CfnRemediationConfiguration.ResourceValueProperty` results in generating invalid cloudFormation template such that the schema keys start with lower-case letters causing failure to validate and deploy the template. resourceValue, staticValue, value and values (keys) start with lowercase in the generated template output.

### Reproduction Steps
```py
s3_encryption_rule = ManagedRule(self, "S3BucketServerSideEncryptionEnabled",
identifier="S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED",
config_rule_name="S3BucketServerSideEncryptionEnabled",
input_parameters={})

s3_encryption_rule.scope_to_resource("AWS::S3::Bucket")

automation_assume_role = CfnRemediationConfiguration.RemediationParameterValueProperty(
static_value=CfnRemediationConfiguration.StaticValueProperty(values=["arn:aws:iam::" + Aws.ACCOUNT_ID + ":role/AutoRemediationRole"]))

resource_value = CfnRemediationConfiguration.RemediationParameterValueProperty(
resource_value=CfnRemediationConfiguration.ResourceValueProperty(value="RESOURCE_ID"))

sse_algorithm = CfnRemediationConfiguration.RemediationParameterValueProperty(
static_value=CfnRemediationConfiguration.StaticValueProperty(values=["AES256"]))

remediation = CfnRemediationConfiguration(s3_encryption_rule,
id="AutoRemediationForS3EncryptionRule",
config_rule_name="S3BucketServerSideEncryptionEnabled",
target_id="AWS-EnableS3BucketEncryption",
target_type="SSM_DOCUMENT",
target_version="1",
automatic=True,
maximum_automatic_attempts=5,
retry_attempt_seconds=60,
parameters={"AutomationAssumeRole": automation_assume_role,
"BucketName": resource_value, "SSEAlgorithm": sse_algorithm})
```

### Error Log

cdk deploy:
```console
Property validation failure: [Encountered unsupported properties in {/Parameters/AutomationAssumeRole}: [staticValue], Encountered unsupported properties in {/Parameters/BucketName}: [resourceValue], Encountered unsupported properties in {/Parameters/SSEAlgorithm}: [staticValue]]
```
### Environment

- **CLI Version :** 2.0.27
- **Framework Version:** aws cdk 1.50.0 (build 84acc92)
- **Node.js Version:** v14.5.0
- **OS :** Mac OS X Catalina 10.15.5
- **Language (Version):** Python/3.8.3

### Other

The following is getting generated in the CFN template:
```json
"resourceValue": {
"value": "RESOURCE_ID"
}

"staticValue": {
"values": [
"AES256"
]
}
```
resourceValue, staticValue, value and values start with lowercase in the generated template output which is causing the error.
Please note that if I change the mentioned keys in the generated template to: ResourceValue, StaticValue, Value and Values
the validation and deployment works as expected hence the cloud-formation template becomes valid.

The following function works as a workaround in Python (converting the values afterwards which is not ideal obviously:
```py
def normalised_dict(d):
normalised_data = {}
for k, v in d.items():
if isinstance(v, dict):
v = normalised_dict(v)
normalised_data[k[0].upper()+k[1:]] = v
return normalised_data
```

---

This is :bug: Bug Report

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Python example and inspecting the generated CloudFormation template for CfnRemediationConfiguration parameters. Trace how the schema properties are generated and serialized, then verify that ResourceValue, StaticValue, Value, and Values are accepted by deployment without the reported validation errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.