(custom-resources): unable to use a tokens in dictionary keys in AwsCustomResource

[eladb]

Reproduction Steps

In the following example, we are using CfnJson to render the request for a dynamodb:BatchWriteItem request. The reason CfnJson is needed is because this request has the table name as a dictionary key. Since table name can only be resolved during deployment, we need to pass it through CfnJson so it is serialized appropriately.

const table = new Table(this, 'MyDynamoTable', { partitionKey: { name: 'ID', type: AttributeType.STRING } });
const cfnJson = new CfnJson(this, 'Request', {
  value: {
    RequestItems: {
      [table.tableName]: [
        { PutRequest: { Item: { ID: { S: 'Item1' }, Value: { S: 'World' } } } },
        { PutRequest: { Item: { ID: { S: 'Item2' }, Value: { S: 'World' } } } }
      ]
    }          
  }
});

new AwsCustomResource(this, 'BatchWrite', {
  onCreate: {
    action: 'batchWriteItem',
    service: 'DynamoDB',
    physicalResourceId: PhysicalResourceId.of('PHYSICAL_RESOURCE_ID'),
    parameters: cfnJson,
  },
  policy: AwsCustomResourcePolicy.fromSdkCalls({ resources: [ table.tableArn ] })
});

What did you expect to happen?

We expected "parameters" to resolve from the CfnJson custom resource's "Value" attribute:

"parameters": { "Fn::GetAtt": [ "Request4BE5F30C", "Value" ] }

What actually happened?

The output CloudFormation template renders like this:

"parameters": {
  "Fn::Join": [
    "",
    [
      "{\"RequestItems\":{\"",
      {
        "Ref": "MyDynamoTableACB5AA21"
      },
      "\":[{\"PutRequest\":{\"Item\":{\"ID\":{\"S\":\"Item1\"},\"Value\":{\"S\":\"World\"}}}},{\"PutRequest\":{\"Item\":{\"ID\":{\"S\":\"Item2\"},\"Value\":{\"S\":\"World\"}}}}]}}"
    ]
  ]
}

Environment

• CDK CLI Version : 1.89.0
• Framework Version: 1.89.0
• Node.js Version: v14.15.4
• OS : Mac
• Language (Version): TypeScript

Other

The root cause seems to be the fact that encodeBoolean calls JSON.stringify() on the parameters object here, combined with the fact that CfnJson implements toJSON() here, which returns the encoded JSON string of the /input/ instead of a token to the Value attribute.

I am not 100% sure why toJSON() of CfnJson does not return a token that resolves to the attribute, but I am also wondering if perhaps AwsCustomResource might be able to utilize a similar approach as CfnJson so to allow arbitrary JSON blobs in parameters without restrictions (basically the parameters field will need to be encoded as a string when passed to the AwsCustomResource handler).

Workaround

As a workaround, one can dynamically replace the toJSON() method on the CfnJson object to:

cfnJson.toJSON = () => Stack.of(this).resolve(cfnJson);

---

This is 🐛 Bug Report

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.