!! NOTICE: "ValidationError: Circular dependency between resources" for SecretsManager RotationSchedule with rotationLambda

[skinny85]

Please add your +1 👍 to let us know you have encountered this

Status: IN-PROGRESS

Overview:

When using a RotationSchedule with a rotationLambda, there is a circular dependency that happens between the default IAM Policy of the rotationLambda Role, and the Function itself:

import { Construct, Stack, StackProps } from '@aws-cdk/core';
import * as lambda from '@aws-cdk/aws-lambda';
import * as secretsmanager from '@aws-cdk/aws-secretsmanager';

export class TestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
        super(scope, id, props);

        const secret = new secretsmanager.Secret(this, 'Secret');
        const rotationLambda = new lambda.Function(this, 'RotateLambda', {
            runtime: lambda.Runtime.NODEJS_10_X,
            code: lambda.Code.fromInline('export.handler = event => event;'),
            handler: 'index.handler',
        });
        new secretsmanager.RotationSchedule(this, 'RotationSchedule', {
            secret,
            rotationLambda: rotationLambda,
        });
    }
}

Complete Error Message:

$ yarn cdk deploy
yarn run v1.22.10
TestStack: deploying...
TestStack: creating CloudFormation changeset...

 ❌  TestStack failed: ValidationError: Circular dependency between resources: [RotateLambdaCCE05B95, RotationSchedule2A725270, RotateLambdaServiceRoleDefaultPolicy12636DDF, RotateLambdaInvokeServicePrincipalsecretsmanageramazonawscom32ADD300]
Circular dependency between resources: [RotateLambdaCCE05B95, RotationSchedule2A725270, RotateLambdaServiceRoleDefaultPolicy12636DDF, RotateLambdaInvokeServicePrincipalsecretsmanageramazonawscom32ADD300]

Workaround:

This regression was introduced in CDK version 1.104.0, so if you use a version of CDK 1.103.0 or earlier, you will not be affected.

Solution:

Related Issues:

This was added in #14471.

[skinny85]

Revert of the faulty PR: #14869

[skinny85]

PR with the patch release: #14881

[skinny85]

The fix has been released in CDK version 1.106.1. Resolving.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.