Lakeformation: CDK is re-creating resources when they are not changed

[denys-tyshetskyy]

Describe the bug

CDK is trying to create a new ResourceProperty in the lakeformation, every time the stack is being deployed even when no changes were made. For some resources like DataLocationResourceProperty, it breaks the deployment since provided resource already exists.

Expected Behavior

When nothing changes, the resource shouldn't be attempted to be deployed.

Current Behavior

I am provisioning the lake formation stack as a part of the project and every time deployment happens, even with no changes to lake formation stack whatsoever (other stacks are updated) the resources are being re-created in the lake formation stack.
This breaks the deployment because when DataLocationResourceProperty is attempted to be re-created the stack fails with the error Resource is already registered (Service: AWSLakeFormation; Status Code: 400; Error Code: AlreadyExistsException;

Reproduction Steps

         for bucket in buckets:
            bucket_resource: s3.Bucket = buckets.get(bucket)
            resource_property = lakeformation.CfnPermissions.ResourceProperty(
                data_location_resource=lakeformation.CfnPermissions.DataLocationResourceProperty(
                    s3_resource=bucket_resource.bucket_arn)
            )
            # Register S3 buckets as LF resources
            data_lake_resource = lakeformation.CfnResource(self, f"{bucket_resource}-LFResource",
                                                           resource_arn=bucket_resource.bucket_arn,
                                                           use_service_linked_role=False,
                                                           role_arn=role.role_arn
                                                           )
            lakeformation.CfnPermissions(self, f"{bucket_resource}-GlueDataLocationPermission",
                                         data_lake_principal=glue_principal,
                                         resource=resource_property,
                                         permissions=['DATA_LOCATION_ACCESS']
                                         ).add_dependency(data_lake_resource)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.92.0

Framework Version

No response

Node.js Version

v16.20.1

OS

AWS Linux

Language

Python

Language Version

Python 3.10

Other information

No response

[pahud]

What did you see when you run cdk diff or npx cdk diff ?

If you run cdk diff without any code changes, there should be nothing changed.

[peterwoodworth]

Yes, if there is a diff appearing then that means there is something in your code that is triggering CDK to add more to your template, which could be a bug on your end that we don't have the details on.

If there is no diff appearing, then CloudFormation should not be taking any action. If this does turn out to be the case, we will need to reach out to the service team

[denys-tyshetskyy]

Hi, apologies - it was a naming issue of the resource on my side. This bug can be closed. Cheers Denys CONFIDENTIAL From: Peter Woodworth ***@***.***> Sent: Wednesday, August 23, 2023 8:59 AM To: aws/aws-cdk ***@***.***> Cc: Denys Tyshetskyy ***@***.***>; Author ***@***.***> Subject: Re: [aws/aws-cdk] Lakeformation: CDK is re-creating resources when they are not changed (Issue #26834) Caution: This email originated from outside the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe. Yes, if there is a diff appearing then that means there is something in your code that is triggering CDK to add more to your template, which could be a bug on your end that we don't have the details on. If there is no diff appearing, then CloudFormation should not be taking any action. If this does turn out to be the case, we will need to reach out to the service team - Reply to this email directly, view it on GitHub<#26834 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AVZTFUZHSCNKCULOF5CZBXTXWUMS5ANCNFSM6AAAAAA3ZIDDOE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.