custom-resources: cannot make custom resource lambda function depend on a managed policy

[toxygene]

Describe the bug

I am trying to create an AwsCustomResource with a VPC and role. The role has a managed policy attached to it, which grants the ec2 actions necessary to create a Lambda function within a VPC. I have also manually set the managed policy as a dependency of the AwsCustomResource.

Expected Behavior

Deploys successfully.

Current Behavior

The deploy fails with the following message:

Resource handler returned message: "The provided execution role does not have permissions to call CreateNetworkInterface on EC2 (Service: Lambda, Status Co
de: 400, Request ID: 7fdc9ef3-f44a-4f4f-8f87-b3b438ca9ebd)" (RequestToken: 519f5445-5cd6-1b0e-e5b1-fc55d1ee9e06, HandlerErrorCode: InvalidRequest)

Reproduction Steps

class MyStack extends Stack {
  constructor(scope: Construct, id: string, options: StackProps) {
    super(scope, id, options);

    const vpc = Vpc.fromLookup(
      this,
      'Vpc',
      {
        tags: {
          AccountResourceId: 'Vpc'
        }
      }
    );

    const topic = new Topic(
      this,
      'Topic'
    );

    const role = new Role(
      this,
      'Role',
      {
        assumedBy: new ServicePrincipal('lambda.amazonaws.com')
      }
    );

    const managedPolicy = new ManagedPolicy(
      this,
      'ManagedPolicy',
      {
        roles: [role],
        statements: [
          new PolicyStatement({
            actions: [
              'ec2:CreateNetworkInterface',
              'ec2:DescribeNetworkInterfaces',
              'ec2:DeleteNetworkInterface',
              'ec2:AssignPrivateIpAddresses',
              'ec2:UnassignPrivateIpAddresses',
            ],
            effect: Effect.ALLOW,
            resources: ['*']
          }),
          new PolicyStatement({
            actions: [
              'sns:SetTopicAttributes'
            ],
            effect: Effect.ALLOW,
            resources: [topic.topicArn]
          })
        ]
      }
    );

    const customResource = new AwsCustomResource(
      this,
      'CustomResource',
      {
        onCreate: {
          service: 'sns',
          action: 'SetTopicAttributes',
          parameters: {
            AttributeName: 'SQSSuccessFeedbackSampleRate',
            AttributeValue: '100',
            TopicArn: topic.topicArn,
            Version: '2010-03-31'
          },
          physicalResourceId: PhysicalResourceId.of(`${topic.topicName}-SQSSuccessFeedbackSampleRate`)
        },
        role: role,
        vpc: vpc,
        vpcSubnets: {
          subnetType: SubnetType.PRIVATE_WITH_EGRESS
        }
      }
    );

    customResource.node.addDependency(managedPolicy);
  }
}

Possible Solution

Is it possible to make the AwsCustomResource construct a dependency of the Lambda Function it creates, thus preserving user-space constructs with the AwsCustomResource?

this.node.addDependency(provider);

Additional Information/Context

It is possible to work around this issue by creating the managed policy, then passing it to the constructor of the role.

    const managedPolicy = new ManagedPolicy(
      this,
      'ManagedPolicy',
      {
        statements: [
          new PolicyStatement({
            actions: [
              'ec2:CreateNetworkInterface',
              'ec2:DescribeNetworkInterfaces',
              'ec2:DeleteNetworkInterface',
              'ec2:AssignPrivateIpAddresses',
              'ec2:UnassignPrivateIpAddresses',
            ],
            effect: Effect.ALLOW,
            resources: ['*']
          }),
          new PolicyStatement({
            actions: [
              'sns:SetTopicAttributes'
            ],
            effect: Effect.ALLOW,
            resources: [topic.topicArn]
          })
        ]
      }
    );

    const role = new Role(
      this,
      'Role',
      {
        assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
        managedPolicies: [managedPolicy]
      }
    );

This work around isn't obvious, as it took me a while before I realized it.

CDK CLI Version

2.103.1

Framework Version

No response

Node.js Version

v18.18.2

OS

MacOs 13.6

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

You will need to make sure the custom managed policy would attach to the role before the creation of the custom resource.

One option as you mentioned above is to create the role with your managed policies

const role = new Role(
      this,
      'Role',
      {
        assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
        managedPolicies: [managedPolicy]
      }
    );

Another option is to make the role depend on the managed policies like

role.node.addDependency(managedPolicy)

This ensures the managedPolicy to be created first, and then the role and eventually the custom resource which implicitly depends on the role.

[toxygene]

Perhaps this would be better labeled as an enhancement. I'm proposing adding a dependency between the CustomResource created within the AwsCustomResource and the AwsCustomResource. This change will "chain" any dependencies down to the Lambda Function is created.

To illustrate this, I have created a fork of aws-cdk with these proposed modifications.

https://github.com/toxygene/aws-cdk/tree/toxygene/custom-resources-dependency

My changes can be seen in this commit: toxygene@de3209b

[toxygene]

Closing in favor of new feature request: #28049

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.