@aws-cdk: cdk import always reports pending changes with lambda function w/alias

[perpil]

Describe the bug

When using a Lambda NodeJsFunction with an alias and a function url attached to it, cdk import always reports pending changes even when no changes exist.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Running cdk import when there are no changes to your lambda function should report no pending changes that need to be resolved on existing resources.

Current Behavior

Running cdk deploy then cdk import always reports resource updates, when no resources are updated.

No resource updates or deletes are allowed on import operation. Make sure to resolve pending changes to existing resources, before attempting an import. Updated/deleted resources: ImportReproStack/ImportReproFunction/Resource, ImportReproFunctionCurrentVersionE3152290f48b63b389af562bcca81f410c827bd9, ImportReproStack/FunctionAlias/Resource (--force to override)

Reproduction Steps

Deploy this stack with cdk deploy
Run cdk import

The cdk template is located here

Possible Solution

Using cdk import --force works, but shouldn't be necessary.

Additional Information/Context

No response

CDK CLI Version

2.160.0 (build 7a8ae02)

Framework Version

2.160.0

Node.js Version

20.13.1

OS

MacOS Sonoma 14.6.1

Language

TypeScript

Language Version

No response

Other information

No response

[khushail]

Hi @perpil , thanks for reaching out.

The issue is reproducible. Even without using the alias, I am getting the error display-

Checking the code how cdk import is implemented , I see that in case of when no changes are detected, by default the error the thrown in this function which checks the diff between importableResources -

this ResourceImporter class -

aws-cdk/packages/aws-cdk/lib/import.ts

Line 62 in 4ada3ea

export class ResourceImporter {

checks for the importable resrources and does the needful by invoking this function-

aws-cdk/packages/aws-cdk/lib/import.ts

Line 173 in 4ada3ea

public async discoverImportableResources(allowNonAdditions = false): Promise<DiscoverImportableResourcesResult> {

  public async discoverImportableResources(allowNonAdditions = false): Promise<DiscoverImportableResourcesResult> {
    const currentTemplate = await this.currentTemplate();

    const diff = cfnDiff.fullDiff(currentTemplate, this.stack.template);

    // Ignore changes to CDKMetadata
    const resourceChanges = Object.entries(diff.resources.changes)
      .filter(([logicalId, _]) => logicalId !== 'CDKMetadata');

    // Split the changes into additions and non-additions. Imports only make sense
    // for newly-added resources.
    const nonAdditions = resourceChanges.filter(([_, dif]) => !dif.isAddition);
    const additions = resourceChanges.filter(([_, dif]) => dif.isAddition);

    if (nonAdditions.length) {
      const offendingResources = nonAdditions.map(([logId, _]) => this.describeResource(logId));

      if (allowNonAdditions) {
        warning(`Ignoring updated/deleted resources (--force): ${offendingResources.join(', ')}`);
      } else {
        throw new Error('No resource updates or deletes are allowed on import operation. Make sure to resolve pending changes ' +
          `to existing resources, before attempting an import. Updated/deleted resources: ${offendingResources.join(', ')} (--force to override)`);
      }
    }

so if there are changes which are to be ignored by setting--force, those will be ignored and warning message is displayed
otherwise we get the error message thrown.

Marking this as P2 as the workaround exists ( running command with --force) , which means it might not be immediately addressed by the team but would be on their radar.

[iankhou]

Fixed in #33322

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.