search

StyraInc / opa-aws-cloudformation-hook

AWS Cloudformation Hook for OPA-powered infrastructure policy enforcement
Apache License 2.0
35 stars 5 forks source link

Find out why boolean properties are converted to strings #3

Closed anderseknert closed 2 years ago

anderseknert commented 2 years ago

The resource schema definition for the AWS resources clearly state that some properties are boolean. Yet, when sent to OPA, they are presented as strings ("true"/"false"). We should see why this happens and fix it before we publish anything.

anderseknert commented 2 years ago

My first guess was that this would be some JSON serialization issue... however, these attributes are strings already when logged into cloudwatch: 

LOG.info(request.hookContext.targetModel.get("resourceProperties"))

🤔

anderseknert commented 2 years ago

Oddly, strings seem to be used in the Python example provided by AWS as well. I guess we'll need to live with this then, but it would be good to get an explanation...

anderseknert commented 2 years ago

This blog talks about boolean strings in the context of cloudformation parameters, but doesn't really explain why booleans would be treated as strings in other contexts.

anderseknert commented 2 years ago

Finally some confirmation: https://forums.aws.amazon.com/thread.jspa?threadID=302268

What you have observed is a known behaviour with the CloudFormation service, which has been reported by other customers as well. As of now, you will have to convert the string value to bool inside your custom resource code.

CloudFormation team is already aware of this limitation and they are actively working on it, but no ETA is presently available.

The above response is from an AWS employee in 2019, so it's probably safe to assume that this will never be fixed :( Closing.