AWS::EFS::FileSystem - FileSystemPolicy-needs separate resource

[rectalogic]

AWS::EFS::FileSystem-FileSystemPolicy is currently a JSON document. It needs to also support a separate FileSystemPolicy CFN resource because the policy often references AWS::EFS::AccessPoint which references AWS::EFS::FileSystem which is circular dependency and so not useable.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-filesystem.html#cfn-efs-filesystem-filesystempolicy

2. Scope of request

new attribute for an existing resource and new resource is desired

4. Test case

See attached template, fails with:

Circular dependency between resources: [FileSystem8A8E25C0, FileSystemaw2AccessPointA083D7E1]

filesystempolicy.json.zip

6. Category (required) - Will help with tagging and be easier to find by other users to +1

Storage (EFS)

[mahngiel]

Commenting in support as I'm facing this issue as well. Here is my snippet

  EFSAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref ElasticFileSystem
      PosixUser:
        Gid: "1001"
        Uid: "1001"
      RootDirectory:
        Path: "/"
        CreationInfo:
          OwnerGid: "1001"
          OwnerUid: "1001"
          Permissions: "775"

  ElasticFileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      PerformanceMode: generalPurpose
      Encrypted: true
      FileSystemPolicy: 
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - elasticfilesystem:ClientWrite
            Principal:
              AWS: !GetAtt InstanceRole.Arn
            Condition:
              Bool:
                elasticfilesystem:AccessViaMountTarget: true
          - Effect: "Allow"
            Action:
              - elasticfilesystem:ClientMount
            Principal:
              AWS: !GetAtt InstanceRole.Arn
            Condition:
              StringEquals:
                elasticfilesystem:AccessPointArn: !GetAtt EFSAccessPoint.Arn

[akremer]

This is still an issue. It is currently impossible to create file system policies that refer to access points, since that creates a circular dependency. The FileSystemPolicy needs to be broken out into a separate resource.

[JayeMcC]

Just started using CDK and encountered this issue. The idea that I can create an EFS and access points and then have to write a lambda to retrieve those in a separate stack just so that I can add some policies to govern the access points is crazy.

I think Terraform just splits them out.

[JiadongLiu]

Using CDK 2.161.1 to create an EFS with access point and try to grant the resource based IAM policy by specifying access point id failed with same error.

I hope we can have a fix for this one