[redshift] Cyclic dependency between redshift and lambda in different stacks

[alex9311]

using allow_default_port_from on a redshift cluster in in the other stack creates a cyclic reference

Reproduction Steps

from aws_cdk import core
from aws_cdk import aws_redshift
from aws_cdk import aws_lambda
from aws_cdk import aws_ec2


app = core.App()

cluster_stack = core.Stack(app, "stack1")
lambda_stack = core.Stack(app, "stack2")

vpc = aws_ec2.Vpc(cluster_stack, "vpc")
cluster = aws_redshift.Cluster(
        cluster_stack,
        "redshift-cluster",
        master_user=(aws_redshift.Login(master_username='master_username')),
        vpc=vpc)

lambda_function = aws_lambda.Function(lambda_stack, "lambdaFunction",
  code= aws_lambda.Code.from_inline("whatever"),
  handler="index.handler",
  runtime=aws_lambda.Runtime.NODEJS_10_X,
  vpc=vpc
)

cluster.connections.allow_default_port_from(lambda_function)

app.synth()

What did you expect to happen?

I want to define my cluster in one stack and my lambda functions that access it in another

What actually happened?

jsii.errors.JSIIError: 'stack1' depends on 'stack2' (stack1 -> stack2/lambdaFunction/SecurityGroup/Resource.GroupId). Adding this dependency (stack2 -> stack1/vpc/Resource.Ref) would create a cyclic reference.
Subprocess exited with error 1

Environment

• CLI Version : 1.47.1
• Framework Version: 1.64.1
• Node.js Version: v10.15.3
• OS : ubuntu 18.04
• Language (Version): python3.8

Other

---

This is 🐛 Bug Report

[njlynch]

Thanks for the report and repro steps.

It looks like the cluster stack is (rightly) taking a dependency on the Lambda's security groups, and the Lambda stack has a dependency on the VPC.

Do you have some flexibility in how you set up your infrastructure? My first recommendation would actually be to create the VPC in its own stack. Often, VPCs have different lifecycles than the other components of an app anyway -- very long-lived and slow-moving vs the faster development of the components. One approach that works here would be to do this:

vpc_stack = core.Stack(app, "vpc_stack")
vpc = aws_ec2.Vpc(vpc_stack, "vpc")

Then use the VPC as you are currently doing in both the other stacks. This would fix the cyclic dependency.

The other option would be to define the VPC in your Lambda stack, if that makes sense for your architecture.

Do either of those work for you?

[alex9311]

Hi @njlynch, thanks for the detailed response! Adding a third stack with just the VPC seems like a great solution -- I'll try that.

Thanks!

[alex9311]

Sorry to re-open, the third stack for the VPC solved one of my issues but I quickly ran into another cyclic dependency issue

I'm trying to pass the cluster hostname to my lambda function as an environment variable. If both the cluster.connections.allow_default_port_from(lambda_function) and the cluster.cluster_endpoint.hostname in stack1's lambda are used, a cyclic error is returned when I synth

jsii.errors.JSIIError: 'stack1' depends on 'stack2' (stack1 -> stack2/lambdaFunction/SecurityGroup/Resource.GroupId). Adding this dependency (stack2 -> stack1/redshift-cluster/Resource.Endpoint.Address) would create a cyclic reference.

I suppose this makes sense but it seems like a common enough use-case, no? It doesn't look like the cluster hostname is something I can hard-code in my cdk.json and pass to both stacks. Any suggestions on how to architect this sort of thing?

from aws_cdk import core
from aws_cdk import aws_redshift
from aws_cdk import aws_lambda
from aws_cdk import aws_ec2


app = core.App()

vpc_stack = core.Stack(app, "stack0")
vpc = aws_ec2.Vpc(vpc_stack, "vpc")

cluster_stack = core.Stack(app, "stack1")
cluster = aws_redshift.Cluster(
    cluster_stack,
    "redshift-cluster",
    master_user=(aws_redshift.Login(master_username='master_username')),
    vpc=vpc)

lambda_stack = core.Stack(app, "stack2")
lambda_function = aws_lambda.Function(
    lambda_stack,
    "lambdaFunction",
    code= aws_lambda.Code.from_inline("whatever"),
    handler="index.handler",
    runtime=aws_lambda.Runtime.NODEJS_10_X,
    vpc=vpc,
    environment= {
        "REDSHIFT_CLUSTER_HOST": cluster.cluster_endpoint.hostname
    }
)

cluster.connections.allow_default_port_from(lambda_function)

app.synth()

[njlynch]

Hey @alex9311 , can you give this a shot?

from aws_cdk import core
from aws_cdk import aws_redshift
from aws_cdk import aws_lambda
from aws_cdk import aws_ec2

app = core.App()

vpc_stack = core.Stack(app, "stack0")
vpc = aws_ec2.Vpc(vpc_stack, "vpc")

cluster_stack = core.Stack(app, "stack1")
cluster = aws_redshift.Cluster(
    cluster_stack,
    "redshift-cluster",
    master_user=(aws_redshift.Login(master_username='master_username')),
    vpc=vpc)

lambda_stack = core.Stack(app, "stack2")
lambda_function = aws_lambda.Function(
    lambda_stack,
    "lambdaFunction",
    code= aws_lambda.Code.from_inline("whatever"),
    handler="index.handler",
    runtime=aws_lambda.Runtime.NODEJS_10_X,
    vpc=vpc,
    environment= {
        "REDSHIFT_CLUSTER_HOST": cluster.cluster_endpoint.hostname
    }
)

# Flip the order of the connection to change which stack owns the resource
# cluster.connections.allow_default_port_from(lambda_function) 
lambda_function.connections.allow_to(cluster, aws_ec2.Port.tcp(cluster.cluster_endpoint.port))

app.synth()

See #1654 (comment) for some background on this decision.

[alex9311]

@njlynch that works great! Thank you