aws_cdk.aws_sqs.Queue: CDK version upgrade causes grant_consume_messages to not generate IAM policy #33548
Labels
@aws-cdk/aws-sqs
Related to Amazon Simple Queue Service
bug
This issue is a bug.
needs-reproduction
This issue needs reproduction.
p2
Comments
rblin081
added
bug
github-actions
bot
added
the
@aws-cdk/aws-sqs
ashishdhingra
added
p2
needs-reproduction
|
Taking below CDK code (in TypeScript) as an example: import * as cdk from 'aws-cdk-lib';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as kms from 'aws-cdk-lib/aws-kms';
export class CdktestStackNew extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const kmsKey = new kms.Key(this, 'TestKmsKey');
const sqsWorkerRole = new iam.Role(this, 'TestSqsWorkerRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
});
const mainQueue = new sqs.Queue(this, 'TestQueue', {
queueName: 'TestQueue',
encryption: sqs.QueueEncryption.KMS,
encryptionMasterKey: kmsKey,
deadLetterQueue: {
queue: new sqs.Queue(this, 'TestDeadLetterQueue'),
maxReceiveCount: 3
}
});
mainQueue.grantConsumeMessages(sqsWorkerRole);
}
}Using aws-cdk-lib version Resources:
TestKmsKeyF793768B:
Type: AWS::KMS::Key
Properties:
KeyPolicy:
Statement:
- Action: kms:*
Effect: Allow
Principal:
AWS: arn:aws:iam::<<ACCOUNT-ID>>:root
Resource: "*"
Version: "2012-10-17"
UpdateReplacePolicy: Retain
DeletionPolicy: Retain
Metadata:
aws:cdk:path: CdktestStackNew/TestKmsKey/Resource
TestSqsWorkerRoleD45AABD6:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
Metadata:
aws:cdk:path: CdktestStackNew/TestSqsWorkerRole/Resource
TestSqsWorkerRoleDefaultPolicy3CB712B5:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- sqs:ChangeMessageVisibility
- sqs:DeleteMessage
- sqs:GetQueueAttributes
- sqs:GetQueueUrl
- sqs:ReceiveMessage
Effect: Allow
Resource:
Fn::GetAtt:
- TestQueue6F0069AA
- Arn
- Action: kms:Decrypt
Effect: Allow
Resource:
Fn::GetAtt:
- TestKmsKeyF793768B
- Arn
Version: "2012-10-17"
PolicyName: TestSqsWorkerRoleDefaultPolicy3CB712B5
Roles:
- Ref: TestSqsWorkerRoleD45AABD6
Metadata:
aws:cdk:path: CdktestStackNew/TestSqsWorkerRole/DefaultPolicy/Resource
TestDeadLetterQueueB2C49D29:
Type: AWS::SQS::Queue
UpdateReplacePolicy: Delete
DeletionPolicy: Delete
Metadata:
aws:cdk:path: CdktestStackNew/TestDeadLetterQueue/Resource
TestQueue6F0069AA:
Type: AWS::SQS::Queue
Properties:
KmsMasterKeyId:
Fn::GetAtt:
- TestKmsKeyF793768B
- Arn
QueueName: TestQueue
RedrivePolicy:
deadLetterTargetArn:
Fn::GetAtt:
- TestDeadLetterQueueB2C49D29
- Arn
maxReceiveCount: 3
UpdateReplacePolicy: Delete
DeletionPolicy: Delete
Metadata:
aws:cdk:path: CdktestStackNew/TestQueue/Resource
CDKMetadata:
Type: AWS::CDK::Metadata
Properties:
Analytics: v2:deflate64:H4sIAAAAAAAA/y2Lyw7CIBBFv6V7GEvThXuX3Sh+gEE6JpRX7BSbhvDvRnB1Tm7OHUCMAvpO7cT1bLkzT8j3TWnL1E6PbD1BnvBgl1eY8CjMKA9ZRoe/pfIandE1aFYYvQnyLWGqUZVSmESKadXt+PfCQpwRFjp9xBmGHsZuIWP4msJmPIJs/AI0SSx6pgAAAA==
Metadata:
aws:cdk:path: CdktestStackNew/CDKMetadata/Default
Parameters:
BootstrapVersion:
Type: AWS::SSM::Parameter::Value<String>
Default: /cdk-bootstrap/hnb659fds/version
Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]Running Upgrading to aws-cdk-lib version Resources:
TestKmsKeyF793768B:
Type: AWS::KMS::Key
Properties:
KeyPolicy:
Statement:
- Action: kms:*
Effect: Allow
Principal:
AWS: arn:aws:iam::<<ACCOUNT-ID>>:root
Resource: "*"
Version: "2012-10-17"
UpdateReplacePolicy: Retain
DeletionPolicy: Retain
Metadata:
aws:cdk:path: CdktestStackNew/TestKmsKey/Resource
TestSqsWorkerRoleD45AABD6:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
Metadata:
aws:cdk:path: CdktestStackNew/TestSqsWorkerRole/Resource
TestSqsWorkerRoleDefaultPolicy3CB712B5:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- sqs:ChangeMessageVisibility
- sqs:DeleteMessage
- sqs:GetQueueAttributes
- sqs:GetQueueUrl
- sqs:ReceiveMessage
Effect: Allow
Resource:
Fn::GetAtt:
- TestQueue6F0069AA
- Arn
- Action: kms:Decrypt
Effect: Allow
Resource:
Fn::GetAtt:
- TestKmsKeyF793768B
- Arn
Version: "2012-10-17"
PolicyName: TestSqsWorkerRoleDefaultPolicy3CB712B5
Roles:
- Ref: TestSqsWorkerRoleD45AABD6
Metadata:
aws:cdk:path: CdktestStackNew/TestSqsWorkerRole/DefaultPolicy/Resource
TestDeadLetterQueueB2C49D29:
Type: AWS::SQS::Queue
UpdateReplacePolicy: Delete
DeletionPolicy: Delete
Metadata:
aws:cdk:path: CdktestStackNew/TestDeadLetterQueue/Resource
TestQueue6F0069AA:
Type: AWS::SQS::Queue
Properties:
KmsMasterKeyId:
Fn::GetAtt:
- TestKmsKeyF793768B
- Arn
QueueName: TestQueue
RedrivePolicy:
deadLetterTargetArn:
Fn::GetAtt:
- TestDeadLetterQueueB2C49D29
- Arn
maxReceiveCount: 3
UpdateReplacePolicy: Delete
DeletionPolicy: Delete
Metadata:
aws:cdk:path: CdktestStackNew/TestQueue/Resource
CDKMetadata:
Type: AWS::CDK::Metadata
Properties:
Analytics: v2:deflate64:H4sIAAAAAAAA/yWKyw6CMBAAv4X7di3EA3ePXBQ+wNSyJqWvyFIJafrvxnKayWQ6bHuJslE7Cz1b4cwL87QpbUHt/MzWM+aBDri9w0BHAaM85jE6+pfKe3RG1+G0AvxhzI9EqU5VSoGROKZVU4EQZ8KFL9+2x07itVnYGLGmsBlPOJ78AcGqfXSaAAAA
Metadata:
aws:cdk:path: CdktestStackNew/CDKMetadata/Default
Parameters:
BootstrapVersion:
Type: AWS::SSM::Parameter::Value<String>
Default: /cdk-bootstrap/hnb659fds/version
Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]Running @rblin081 Good morning. Could you please share the self contained reproducible code and steps to troubleshoot the issue? Also share the output of In your code, sqs_worker_stack is a separate stack that owns IAM user sqs_worker_user. Is it possible that the other stack changed any user property or it's name? Thanks, |
ashishdhingra
added
the
response-requested
|
This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled. |
github-actions
bot
added
the
closing-soon
|
Comment since Bot is too fast here... |
github-actions
bot
removed
closing-soon
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
When upgrading to the latest CDK version
2.179.0there are several stack with IAM policies being dropped.The policies are generated from using the
grant_consume_messagemethod foraws_sqs.Queue(link)An example of the application code is
Regression Issue
Last Known Working CDK Version
2.141.0
Expected Behavior
grant_consume_messageswould continue to generate IAM policies for the associated queue and grantable constructCurrent Behavior
grant_consume_messagesis not creating IAM policies for the IAM user / grantable constructReproduction Steps
Generated diff using CDK version
2.179.0Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.179.0 (build b867f19)
Framework Version
No response
Node.js Version
v18.15.0
OS
macos Sequoia version 15.2
Language
Python
Language Version
Python 3.10.6
Other information
No response
The text was updated successfully, but these errors were encountered: