aws-stepfunctions-tasks: Custom resources being provisioned when passing in subnets to EcsRunTask

[marsavar]

Describe the bug

I'm attempting to cloudform an EcsRunTask (with no context file).
Not passing the subnet prop results in this error:

There are no 'Private' subnet groups in this VPC.

This is somewhat expected, CDK doesn't know at compile time what subnet groups are in a VPC.
Passing in an array of private subnets (whose ids are stored in an SSM param) causes CDK to provision custom resources when passing the subnets prop to EcsRunTask.

For reasons I don't fully understand, CDK attempts to cloudform a lambda to be served from an S3 bucket. The following parameters are also created:

• Asset hash
• S3 bucket name
• S3 bucket version number

Because these parameters do not have any values, it is not possible to update the stack.

Expected Behavior

I expect CDK to reference the private subnets I'm passing to the EcsRunTask construct.

Current Behavior

synth works as expected, but updating the stack with the newly generated template fails due to the parameters not having values.

The parameters being generated are

"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0ArtifactHashAF1370F8": {
      "Description": "Artifact hash for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
      "Type": "String",
    },
    "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7": {
      "Description": "S3 bucket for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
      "Type": "String",
    },
    "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F": {
      "Description": "S3 key for asset version "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
      "Type": "String",
    },

and the custom resource (a node lambda):

  "AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57": {
      "DependsOn": [
        "AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
      ],
      "Properties": {
        "Code": {
          "S3Bucket": {
            "Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7",
          },
          "S3Key": {
            "Fn::Join": [
              "",
              [
                {
                  "Fn::Select": [
                    0,
                    {
                      "Fn::Split": [
                        "||",
                        {
                          "Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
                        },
                      ],
                    },
                  ],
                },
                {
                  "Fn::Select": [
                    1,
                    {
                      "Fn::Split": [
                        "||",
                        {
                          "Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
                        },
                      ],
                    },
                  ],
                },
              ],
            ],
          },
        },
        "Handler": "__entrypoint__.handler",
        "MemorySize": 128,
        "Role": {
          "Fn::GetAtt": [
            "AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
            "Arn",
          ],
        },
        "Runtime": "nodejs16.x",
        "Timeout": 900,
      },
      "Type": "AWS::Lambda::Function",
    },
    "AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "ManagedPolicyArns": [
          {
            "Fn::Sub": "arn:\${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
          },
        ],
      },
      "Type": "AWS::IAM::Role",
    },
    "CdkJsonStringify2": {
      "DeletionPolicy": "Delete",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57",
            "Arn",
          ],
        },
        "Value": {
          "Ref": "ecstestPrivateSubnets",
        },
      },
      "Type": "Custom::AWSCDKCfnJsonStringify",
      "UpdateReplacePolicy": "Delete",
    },

Reproduction Steps

This is a complex construct that requires several props to be defined, so I'm including an example for our repository.

https://github.com/guardian/cdk/blob/effb29ee6aaa8cd72bd10102649991eb55067c3c/src/constructs/ecs/ecs-task.ts#L206-L223

Removing the subnets prop gets rid of the custom resources.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.78.0

Framework Version

No response

Node.js Version

v18.16.0

OS

macOS Monterey 12.6.2

Language

Typescript

Language Version

TypeScript 4.9.5

Other information

No response

[pahud]

You will need to provide ec2.SubnetSelection to the subnet property. Looking at your code, you are not actually providing the SubnetSelection and the subnetsFromParameter actually returns ISubnet[] instead of SubnetSelection.

https://github.com/guardian/cdk/blob/effb29ee6aaa8cd72bd10102649991eb55067c3c/src/constructs/ecs/ecs-task.ts#L161

[marsavar]

Ah, that's just a prop for a wrapper around EcsRunTask.
It gets passed to the real EcsRunTaskas an ec2.SubnetSelection on L208: https://github.com/guardian/cdk/blob/effb29ee6aaa8cd72bd10102649991eb55067c3c/src/constructs/ecs/ecs-task.ts#L208

SubnetSelection's fields are all optional, including subnets: ISubnet[] so subnets: { subnets } is a valid SubnetSelection. TypeScript would complain if it wasn't.

[ashishdhingra]

@marsavar Good afternoon. Could you please confirm if your are unblocked and if this issue could be closed?

Thanks,
Ashish

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.