[custom-resources] getResponseField does not function properly when iterating over lists

[DarkmatterVale]

When using the getResponseField method in a custom resource, it does not properly iterate over lists.

Reproduction Steps

1. Create a VPC
2. Add S3 & DynamoDB gateway endpoints in the vpc
3. Create a security group (name in this example: lambdaSg with setting allowAllOutbound: false)
4. Use a custom resource to call the AWS API to get the prefix lists, add them as egress targets for the security group:

const prefixListCall = new cr.AwsCustomResource(stack, 'GetPrefixListIds', {
    resourceType: 'Custom::GetPrefixListIds',
    onUpdate: {
        region: "REGION-HERE",
        service: 'EC2',
        action: 'describePrefixLists',
        parameters: {
            MaxResults: 10
        },
        physicalResourceId: cr.PhysicalResourceId.of('GetPrefixListIdsFunction')
    },
    policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE
    })
});
lambdaSg.connections.allowTo(ec2.Peer.prefixList(prefixListCall.getResponseField('PrefixLists.0.PrefixListId')), ec2.Port.allTraffic());
lambdaSg.connections.allowTo(ec2.Peer.prefixList(prefixListCall.getResponseField('PrefixLists.1.PrefixListId')), ec2.Port.allTraffic());

What did you expect to happen?

When I execute the above CDK and check the outbound rules for the security group in the console, I see 2 rules: one for the 0th item (PrefixLists.0.PrefixListId), and one for the 1st item (PrefixLists.1.PrefixListId).

What actually happened?

When I execute the above CDK and check the outbound rules for the security group in the console, I see only 1 rule for the 0th item (PrefixLists.0.PrefixListId).

Environment

• CLI Version : 1.39
• Framework Version: 1.39
• Node.js Version: 14.0.5
• OS : Mac OS X
• Language (Version): TypeScript (3.9.3)

Other

If I replace prefixListCall.getResponseField(...) with hardcoded strings, everything works as expected.

---

This is 🐛 Bug Report

[jogold]

Can you show the resulting CF template?

[peterwoodworth]

the allowTo method uses addEgressRule under the hood, so i suspect that the cause of this is the issue I've just posted #17201. Please go there to track this issue :)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.