Describe the bug
When a AwsCustomResource that uses assumedRoleArn for the onDelete operation is deleted, an error may occur if the physicalResourceId contains characters not allowed in an STS session name.
This appears to be caused by this line:
|
RoleSessionName: `${timestamp}-${physicalResourceId}`.substring(0, 64), |
where the resource physical ID is used to construct the session name for the AssumeRole operation.
Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
Role is assumed correctly and operation is invoked using the role
Current Behavior
An error is returned in cloudformation:
Received response status [FAILED] from custom resource. Message returned: 1 validation error detected: Value '1743579449324-arn:aws:sns:ap-southeast-2:<redacted>:TestCaseTo' at 'roleSessionName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w+=,.@-]* (RequestId: 5b8c8276-00d0-4c83-82f0-d1e00d91b90b)
Reproduction Steps
Deploy and then attempt to delete the following stack:
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
export class TestCaseBugStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: cdk.StackProps) {
super(scope, id, props);
const assumedRole = new cdk.aws_iam.Role(this, 'AssumedRole', {
assumedBy: new cdk.aws_iam.AccountRootPrincipal(),
inlinePolicies: {
ManageTopic: new cdk.aws_iam.PolicyDocument({
statements: [new cdk.aws_iam.PolicyStatement({
actions: ['sns:CreateTopic', 'sns:DeleteTopic'],
resources: ['*'],
})],
}),
},
});
new cdk.custom_resources.AwsCustomResource(this, 'TestCase', {
installLatestAwsSdk: false,
onCreate: {
assumedRoleArn: assumedRole.roleArn,
service: 'sns',
action: 'CreateTopic',
parameters: {
Name: 'TestCaseTopic',
},
physicalResourceId: cdk.custom_resources.PhysicalResourceId.fromResponse('TopicArn'),
},
onDelete: {
assumedRoleArn: assumedRole.roleArn,
service: 'sns',
action: 'DeleteTopic',
parameters: {
TopicArn: new cdk.custom_resources.PhysicalResourceIdReference(),
},
},
policy: cdk.custom_resources.AwsCustomResourcePolicy.fromSdkCalls({ resources: [] }),
});
}
}
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.1006.0 (build a3b9762)
Framework Version
v2.187.0
Node.js Version
20.13.1
OS
MacOS 14.3 (23D56)
Language
TypeScript
Language Version
No response
Other information
No response
Describe the bug
When a
AwsCustomResourcethat usesassumedRoleArnfor the onDelete operation is deleted, an error may occur if thephysicalResourceIdcontains characters not allowed in an STS session name.This appears to be caused by this line:
aws-cdk/packages/@aws-cdk/custom-resource-handlers/lib/custom-resources/aws-custom-resource-handler/utils.ts
Line 108 in 009680d
where the resource physical ID is used to construct the session name for the AssumeRole operation.
Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
Role is assumed correctly and operation is invoked using the role
Current Behavior
An error is returned in cloudformation:
Reproduction Steps
Deploy and then attempt to delete the following stack:
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.1006.0 (build a3b9762)
Framework Version
v2.187.0
Node.js Version
20.13.1
OS
MacOS 14.3 (23D56)
Language
TypeScript
Language Version
No response
Other information
No response