(lambda): lambda function is missing deps when using efs

[ddneilson]

When providing a filesystem to a Lambda Function, the function is missing dependencies on security group ingress/egress rules that get created. If, for any reason, the Lambda Function would be executed during the Cfn deployment (e.g. used as a Custom Resource provider) then it is possible for initialization of the Lambda Function to fail due to being unable to connect to the filesystem. If this failure happens in a Custom Resource, then the Lambda is unable to inform CloudFormation of the failure and you're stuck waiting for the stack deployment to time out.

Reproduction Steps

  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 28
        },
        {
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE,
          cidrMask: 26
        },
      ]
    });

    const fileSystem = new efs.FileSystem(this, 'EfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
    const accessPoint = new efs.AccessPoint(this, 'AccessPoint', {
      fileSystem,
      createAcl: {
        ownerGid: '10000',
        ownerUid: '10000',
        permissions: '750',
      },
      path: '/Subdir', 
      posixUser: {
        uid: '10000',
        gid: '10000',
      },
    });

    const lambdaSG = new ec2.SecurityGroup(this, 'LambdaSG', {
      vpc,
      allowAllOutbound: false,
    });

    new lambda.Function(this, 'LambdaFunction', {
      handler: 'foo.bar',
      memorySize: 128,
      code: lambda.Code.fromAsset(path.join(__dirname, 'lambda')),
      runtime: lambda.Runtime.NODEJS_14_X,
      logRetention: logs.RetentionDays.ONE_WEEK,
      // Required for access point...
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE,
      },
      securityGroups: [ lambdaSG ],
      filesystem: lambda.FileSystem.fromEfsAccessPoint(accessPoint, '/mnt/efs'),
    });
  }

What did you expect to happen?

Lambda Function is created by CloudFormation only after all security group ingress & egress rules required for the lambda to connect to the filesystem have been created.

What actually happened?

Lambda Function randomly gets created before the ingress/egress rules, and then fails to launch.

Environment

• CDK CLI Version : 1.100.0
• Framework Version: 1.100.0
• Node.js Version: N/A
• OS : N/A
• Language (Version): all

Other

PR incoming to fix this...

---

This is 🐛 Bug Report

[nija-at]

Hi @ddneilson -

Thanks for filing this issue. I'm not very familiar with EFS and the ingress/egress rules.

Would it be sufficient/correct if the lambda function depended on the EFS FileSystem resource?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.