AwsCustomResource with delete only action fails with Invalid PhysicalResourceId

[chrisgit]

I have written some lambda backed custom resources using the provider framework but in some cases the task involved is very simple and does not require the overhead of creating a bespoke lambda.

The CDK offers an alternative to the provider framework which is a custom resource that calls an AWS SDK API

Sometimes a single API call can fill the gap in the CloudFormation coverage. In this case you can use the AwsCustomResource construct. This construct creates a custom resource that can be customized to make specific API calls for the CREATE, UPDATE and DELETE events. Additionally, data returned by the API call can be extracted and used in other constructs/resources (creating a real CloudFormation dependency using Fn::GetAtt under the hood).

The physical id of the custom resource can be specified or derived from the data returned by the API call.

The scenarios is that in a development environment I want to remove any CDK generated secrets and KMS keys.

My understanding is that I can use an AwsCustomResource with just the onDelete event specified, however creating the resource produces an Invalid PhysicalResourceId error.

Reproduction Steps

  // Example
  const key = new Key(this, 'kms-key', {
      alias: 'KMS-Test-Delete-Alias',
       description: 'This is a test KMS key using custom resource',
       enabled: true,
   });

  new AwsCustomResource(this, 'kmsDeleteKeyResource', {
             onDelete: {
                service: 'KMS',
                action: 'scheduleKeyDeletion',
                parameters: {
                    KeyId: key.keyArn,
                    PendingWindowInDays: 7
                },
             },
        });

Error Log

5/8 | 14:40:35 | CREATE_COMPLETE      | AWS::KMS::Key         | kms-key (kmskey49FBC3B3)
5/8 | 14:40:37 | CREATE_IN_PROGRESS   | AWS::KMS::Alias       | kms-key/Alias (kmskeyAlias39245779)
5/8 | 14:40:37 | CREATE_IN_PROGRESS   | Custom::AWS           | kmsDeleteKeyResource/Resource/Default (kmsDeleteKeyResource97160D9C)
5/8 Currently in progress: kmskeyAlias39245779, kmsDeleteKeyResource97160D9C
6/8 | 14:41:31 | CREATE_FAILED        | Custom::AWS           | kmsDeleteKeyResource/Resource/Default (kmsDeleteKeyResource97160D9C) Invalid PhysicalResourceId
               new CustomResource (C:\ScratchPad - AWS\cdk\kms-delete-key-api\node_modules\@aws-cdk\aws-cloudformation\lib\custom-resource.ts:163:21)
               \_ new AwsCustomResource (C:\ScratchPad - AWS\cdk\kms-delete-key-api\node_modules\@aws-cdk\custom-resources\lib\aws-custom-resource\aws-custom-resource.ts:209:27)
               \_ new DemoStack (C:\ScratchPad - AWS\cdk\kms-delete-key-api\example\demo-stack.ts:24:9)
               \_ Object.<anonymous> (C:\ScratchPad - AWS\cdk\kms-delete-key-api\example\cdk.ts:6:17)

Environment

• CLI Version : aws-cli/1.16.185 Python/3.7.3 Windows/10 botocore/1.12.175
• Framework Version: aws-cdk@1.22.0
• OS : Windows 10 1803
• Language : Typescript

Other

---

This is 🐛 Bug Report

[eladb]

@jogold would you like to take a look?

[jogold]

@jogold would you like to take a look?

Yes

[jogold]

@chrisgit in the meantime you can use the following workaround:

const key = new Key(this, 'kms-key', {
  alias: 'KMS-Test-Delete-Alias',
    description: 'This is a test KMS key using custom resource',
    enabled: true,
});

new AwsCustomResource(this, 'kmsDeleteKeyResource', {
  onCreate: { // Dummy call
    service: 'KMS',
    action: 'describeKey',
    parameters: {
      KeyId: key.keyArn
    },
    physicalResourceId: key.keyArn,
  },
  onDelete: {
    service: 'KMS',
    action: 'scheduleKeyDeletion',
    parameters: {
        KeyId: key.keyArn,
        PendingWindowInDays: 7
    },
  },
})

[chrisgit]

Thank you very much for taking the time to look at this issue.

@jogold Thank you, the work around provided works as expected.

[jogold]

@eladb what do you think is best here?

• change the API so that we have a new physicalResourceId prop in AwsCustomResourceProps (= default for all type of calls) and keep only physicalResourceIdPath in AwsSdkCall interface that would act as an override for a specific call
• just handle the case of an AwsCustomResource having only a onDelete by automatically providing some sort of default physical resource id for the Create request

[eladb]

I think that making an action with just onDelete "just work" is probably a better experience.