(custom-resources): cannot find response data key

[Lewenhaupt]

Describe the bug

I'm using custom-resources provider with a CustomResource.
Trying to use theCustomResource.getAtt('roleArns.iamDbAuthRoleArn') in aws-cdk fails.

I've verified the provider framework does upload the correct Data to S3, but still I'm unable to retrieve it and I'm at a loss of what I can do...

2023-10-20T15:13:01.747Z	4db3e534-b9ac-4911-bfb1-7433ab6d82b9	INFO	[provider-framework] submit response to cloudformation 
{
    "Status": "SUCCESS",
    "Reason": "SUCCESS",
    "StackId": "<redacted>",
    "RequestId": "<redacted>",
    "PhysicalResourceId": "<redacted>",
    "LogicalResourceId": "RdsIamAuthCreator",
    "Data": {
        "roleArns": {
            "iamDbAuthRoleArn": "<redacted>",
            "retoolReadUserArn": "<redacted>"
        }
    }
}

Expected Behavior

getAtt call to succeed as the key is obviously present in the Data that was put in S3.

Current Behavior

Fails with error CustomResource attribute error: Vendor response doesn't contain roleArns.iamDbAuthRoleArn

Reproduction Steps

Handler:

async (event, context) => {
    logger.info('Processing request', {
      event,
    });

    let result: CloudFormationCustomResourceEventResult | undefined = undefined;

    switch (event.RequestType) {
      case 'Create':
        result = await createFn(event);
        break;
      case 'Update':
        if (updateFn) {
          result = await updateFn(event);
        }
        break;
      case 'Delete':
        if (deleteFn) {
          result = await deleteFn(event);
        }
        break;
      default:
        logger.error(`Unknown request type: ${event['RequestType']}`);
        throw Error(`Unknown request type: ${event['RequestType']}`);
    }
    if (result) {
        return result;
    }
  };

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.69.0 (build 60a5b2a)

Framework Version

No response

Node.js Version

v18.12.1

OS

Macos

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Can you provide minimal full code snippets that we can deploy and check in our environment?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[Lewenhaupt]

I believe it has to do with nested attributes. I was under the impression I could get nested attributes since I can do DBClusters.0.DbClusterResourceId this when I use AwsCustomResource to run an SDK call against RDS to retrieve the physical och a new RDS cluster. But perhaps this is formatted into a flat object before returning to the Custom Resource?

Handler:

export const handler = async (event, context) => {
    let result: any = undefined;

    switch (event.RequestType) {
      case 'Create':
        result = {
          ...event,
          PhysicalResourceId: 'some-random-string',
          Data: {
            a: 'a',
            b: { aB: 'a' },
          },
        };
        break;
      case 'Update':
        if (updateFn) {
          result = {
            ...event,
            PhysicalResourceId: event.PhysicalResourceId,
            Data: {
              a: 'a',
              b: { aB: 'a' },
            },
          };
        }
        break;
      case 'Delete':
        if (deleteFn) {
          result = {
            ...event,
            PhysicalResourceId: event.PhysicalResourceId,
            Data: {
              a: 'a',
              b: { aB: 'a' },
            },
          };
        }
        break;
      default:
        logger.error(`Unknown request type: ${event['RequestType']}`);
        throw Error(`Unknown request type: ${event['RequestType']}`);
    }
    if (result) {
        return result;
    }
  };

Setup a NodeJsFunction, including role and provider:

const lambdaFunction = new lambda.Function(
      this,
      'LambdaFunction',
      {
        runtime: lambda.Runtime.NODEJS_18_X,
        code: aws_lambda.Code.fromAsset(<path to code>),
       handler: 'handler',
      },
    );
const providerRole = new iam.Role(this, 'providerRole', {
      roleName: 'providerRole',
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
      ],
    });

    lambdaFunction.grantInvoke(providerRole);

    const provider = new cr.Provider(this, 'provider', {
      onEventHandler: lambdaFunction,
      role: lambdaBackedCRProviderRole,
    });
const customResource = new CustomResource(this, 'CustomResource', {
      serviceToken: provider.serviceToken,
      properties: {},
    });
// WORKS!
new CfnOutput(this, 'Output1', {
      value: customResource.getAttString('a'),
    });
// DOESN'T WORK!
new CfnOutput(this, 'Output2', {
      value: customResource.getAttString('b.aB'),
    });

[kornicameister]

@Lewenhaupt did you manage to get around nested attributes?

[Lewenhaupt]

@kornicameister nope, I worked around it by creating them in a cr such that I could avoid the nested structure.