Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to synthesize when calling grantInvoke(ServicePrincipal.Builder.create("events.amazonaws.com") #8240

Closed
john-tipper opened this issue May 27, 2020 · 2 comments · Fixed by #8296
Closed

Unable to synthesize when calling grantInvoke(ServicePrincipal.Builder.create("events.amazonaws.com") #8240

john-tipper opened this issue May 27, 2020 · 2 comments · Fixed by #8296
Assignees
@nija-at
Labels
@aws-cdk/aws-lambda Related to AWS Lambda bug This issue is a bug. p0

Comments

@john-tipper
Copy link

john-tipper commented May 27, 2020 •
edited
Loading

There appears to have been a breaking change between 1.38.0 and 1.39.0 for which I cannot find documentation and which continues in recent versions.

I attempt to grant permission to events.amazonaws.com to trigger my lambda, using the code below:

myLambda.grantInvoke(ServicePrincipal.Builder.create("events.amazonaws.com")

When I attempt to synthesize the stack, I get an exception with the message:

No child with id: 'InvokeServicePrincipal(events.amazonaws.com)'

Reproduction Steps

I create a lambda using:

SingletonFunction.create(...)

then attempt to grant permissions to the events AWS service principal:

myLambda.grantInvoke(ServicePrincipal.Builder.create("events.amazonaws.com")

Error Log

Exception in thread "main" software.amazon.jsii.JsiiException: No child with id: 'InvokeServicePrincipal(events.amazonaws.com)'
Error: No child with id: 'InvokeServicePrincipal(events.amazonaws.com)'
    at Node.findChild (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-kernel-38y7OI\node_modules\constructs\lib\construct.js:86:19)
    at ConstructNode.findChild (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-kernel-38y7OI\node_modules\@aws-cdk\core\lib\construct-compat.js:235:45)
    at Object.addToResourcePolicy (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-kernel-38y7OI\node_modules\@aws-cdk\aws-lambda\lib\function-base.js:89:80)
    at Function.addToPrincipalOrResource (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-kernel-38y7OI\node_modules\@aws-cdk\aws-iam\lib\grant.js:50:49)
    at SingletonFunction.grantInvoke (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-kernel-38y7OI\node_modules\@aws-cdk\aws-lambda\lib\function-base.js:75:26)
    at C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7680:51
    at Kernel._wrapSandboxCode (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:8316:19)
    at C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7680:25
    at Kernel._ensureSync (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:8289:20)
    at Kernel.invoke (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7679:26)
    at KernelHost.processRequest (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7388:28)
    at KernelHost.run (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7328:14)
    at Immediate._onImmediate (C:\Users\JOHN~1.TIP\AppData\Local\Temp\jsii-java-runtime10095079647419115433\jsii-runtime.js:7331:37)
    at processImmediate (internal/timers.js:456:21)
        at software.amazon.jsii.JsiiRuntime.processErrorResponse(JsiiRuntime.java:119)
        at software.amazon.jsii.JsiiRuntime.requestResponse(JsiiRuntime.java:91)
        at software.amazon.jsii.JsiiClient.callMethod(JsiiClient.java:183)
        at software.amazon.jsii.JsiiObject.jsiiCall(JsiiObject.java:120)
        at software.amazon.jsii.JsiiObject.jsiiCall(JsiiObject.java:106)
        at software.amazon.awscdk.services.lambda.FunctionBase.grantInvoke(FunctionBase.java:114)
        at com.example.MyStack.<init>(MyStack.java:325)

Environment

  • CLI Version : 1.42.0
  • Framework Version: 1.39.0
  • OS : Windows
  • Language : Java

Other

There is no exception when using 1.38.0, but this issue appears to affect all subsequent versions, including 1.42.0.

This is 🐛 Bug Report
@john-tipper john-tipper added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels May 27, 2020
@SomayaB SomayaB added @aws-cdk/aws-iam Related to AWS Identity and Access Management @aws-cdk/aws-lambda Related to AWS Lambda and removed @aws-cdk/aws-iam Related to AWS Identity and Access Management labels Jun 1, 2020
@nija-at
Copy link
Contributor

nija-at commented Jun 1, 2020

There was no breaking change intended for this module on those releases. @aws-cdk/aws-lambda is a stable module; we will not release breaking changes on minor version releases.

I was able to reproduce this with a simple typescript app -

import { ServicePrincipal } from '@aws-cdk/aws-iam';
import { Code, Runtime, SingletonFunction } from '@aws-cdk/aws-lambda';
import { App, Stack } from '@aws-cdk/core';

const app = new App();
const stack = new Stack(app, 'mystack');

const fn = new SingletonFunction(stack, 'fn', {
  code: Code.fromInline('foo'),
  runtime: Runtime.NODEJS_12_X,
  handler: 'index.handler',
  uuid: '92e0bbf2-10d2-427c-9f79-79f671303428',
});

fn.grantInvoke(new ServicePrincipal('events.amazonaws.com'));

This is a bug.

@nija-at nija-at added the p0 label Jun 1, 2020
@nija-at nija-at mentioned this issue Jun 1, 2020
Closed
@nija-at nija-at removed needs-triage This issue or PR still needs to be triaged. p0 labels Jun 1, 2020
@nija-at
Copy link
Contributor

nija-at commented Jun 1, 2020

We're tracking this bug here - #8295

@nija-at nija-at mentioned this issue Jun 1, 2020
Merged
@nija-at nija-at added the p0 label Jun 1, 2020
@mergify mergify bot closed this as completed in #8296 Jun 1, 2020
mergify bot pushed a commit that referenced this issue Jun 1, 2020
fix(lambda): SingletonFunction.grantInvoke() API fails with error '…
a8b1815 
…No child with id' (#8296)

Updates to the Grant API[1] introduced the need to return the statement
that was added as a result of the grant operation.

A corresponding change[2] was applied to lambda module's `FunctionBase`
class with the intention to apply this across all constructs that are
variants of `Function`.

However, the `SingletonFunction` construct behaves differently in how it
modifies the construct tree. Specifically, it contains no child node but
instead manipulates a node that is a direct child of the `Stack` node.
For this reason, `this.node.findChild()` API does not return the
expected underlying node.

The fix here is to allow such special inheritors of `FunctionBase` to
override where the child node is to be found, via an internal method
called `_functionNode()`.

fixes #8240

[1]: 1819a6b
[2]: 1819a6b#diff-73cb0d8933b87960893373bd263924e2


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
nija-at pushed a commit that referenced this issue Jun 1, 2020
fix(lambda): SingletonFunction.grantInvoke() API fails with error '…
b4e264c 
…No child with id' (#8296)

Updates to the Grant API[1] introduced the need to return the statement
that was added as a result of the grant operation.

A corresponding change[2] was applied to lambda module's `FunctionBase`
class with the intention to apply this across all constructs that are
variants of `Function`.

However, the `SingletonFunction` construct behaves differently in how it
modifies the construct tree. Specifically, it contains no child node but
instead manipulates a node that is a direct child of the `Stack` node.
For this reason, `this.node.findChild()` API does not return the
expected underlying node.

The fix here is to allow such special inheritors of `FunctionBase` to
override where the child node is to be found, via an internal method
called `_functionNode()`.

fixes #8240

[1]: 1819a6b
[2]: 1819a6b#diff-73cb0d8933b87960893373bd263924e2


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@devendra-kumar1 devendra-kumar1 mentioned this issue Dec 29, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nija-at nija-at

Labels
@aws-cdk/aws-lambda Related to AWS Lambda bug This issue is a bug. p0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(lambda): SingletonFunction.grantInvoke() API fails with error 'No child with id' aws/aws-cdk
3 participants
@john-tipper @nija-at @SomayaB