ashishdhingra
commented
5 days ago @terryobot Good morning. Thanks for reporting the issue. Somehow, I'm unable to reproduce the issue using the below similar TypeScript code with latest CDK version 2.162.1 (build 10aa526).
import * as cdk from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
export class CdktestStack extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const lambdaFunction = new lambda.Function(this, 'someLambda', {
runtime: lambda.Runtime.PYTHON_3_12,
handler: 'handler',
code: lambda.Code.fromInline('def handler(context):\n\treturn "hi"'),
timeout: cdk.Duration.minutes(5),
functionName: 'TestFunction'
});
const alarm_1 = new cloudwatch.Alarm(this, "GenericAlarm1", {
alarmName: "Generic_Alarm_1",
metric: new cloudwatch.Metric({
metricName: 'metric_1',
namespace: 'MyNamespace'
}),
threshold: 1,
evaluationPeriods: 2,
comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
});
const alarm_2 = new cloudwatch.Alarm(this, "GenericAlarm2", {
alarmName: "Generic_Alarm_2",
metric: new cloudwatch.Metric({
metricName: 'metric_2',
namespace: 'MyNamespace'
}),
threshold: 1,
evaluationPeriods: 2,
comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
});
alarm_1.addAlarmAction(new cloudwatchActions.LambdaAction(lambdaFunction));
alarm_2.addAlarmAction(new cloudwatchActions.LambdaAction(lambdaFunction));
}
}The above CDK code synthesized to below CFN template:
Resources:
someLambdaServiceRole4F404078:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
ManagedPolicyArns:
- Fn::Join:
- ""
- - "arn:"
- Ref: AWS::Partition
- :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
Metadata:
aws:cdk:path: CdktestStack/someLambda/ServiceRole/Resource
someLambdaA2987FE4:
Type: AWS::Lambda::Function
Properties:
Code:
ZipFile: |-
def handler(context):
return "hi"
FunctionName: TestFunction
Handler: handler
Role:
Fn::GetAtt:
- someLambdaServiceRole4F404078
- Arn
Runtime: python3.12
Timeout: 300
DependsOn:
- someLambdaServiceRole4F404078
Metadata:
aws:cdk:path: CdktestStack/someLambda/Resource
someLambdaGenericAlarm1AlarmPermission8A848112:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName:
Fn::GetAtt:
- someLambdaA2987FE4
- Arn
Principal: lambda.alarms.cloudwatch.amazonaws.com
SourceAccount: "<ACCOUNT_ID>"
SourceArn:
Fn::GetAtt:
- GenericAlarm194B9EE44
- Arn
Metadata:
aws:cdk:path: CdktestStack/someLambda/GenericAlarm1AlarmPermission
someLambdaGenericAlarm2AlarmPermissionE5CC8DA3:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName:
Fn::GetAtt:
- someLambdaA2987FE4
- Arn
Principal: lambda.alarms.cloudwatch.amazonaws.com
SourceAccount: "<ACCOUNT_ID>"
SourceArn:
Fn::GetAtt:
- GenericAlarm2D2747368
- Arn
Metadata:
aws:cdk:path: CdktestStack/someLambda/GenericAlarm2AlarmPermission
GenericAlarm194B9EE44:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmActions:
- Fn::GetAtt:
- someLambdaA2987FE4
- Arn
AlarmName: Generic_Alarm_1
ComparisonOperator: GreaterThanOrEqualToThreshold
EvaluationPeriods: 2
MetricName: metric_1
Namespace: MyNamespace
Period: 300
Statistic: Average
Threshold: 1
TreatMissingData: notBreaching
Metadata:
aws:cdk:path: CdktestStack/GenericAlarm1/Resource
GenericAlarm2D2747368:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmActions:
- Fn::GetAtt:
- someLambdaA2987FE4
- Arn
AlarmName: Generic_Alarm_2
ComparisonOperator: GreaterThanOrEqualToThreshold
EvaluationPeriods: 2
MetricName: metric_2
Namespace: MyNamespace
Period: 300
Statistic: Average
Threshold: 1
TreatMissingData: notBreaching
Metadata:
aws:cdk:path: CdktestStack/GenericAlarm2/Resource
CDKMetadata:
Type: AWS::CDK::Metadata
Properties:
Analytics: v2:deflate64:H4sIAAAAAAAA/02KywrCMBAAv6X3ZDVFxKsInqV+gGyTiNvmAdnEHkL+XWo9eJqBmR7UsQfV4cJSm1k6GqHeM+pZ4MKP6tCPBqFeS9CZYhCXZ/j3m02emCmGJgg91CE6u4aVTWgXi1kw6xfUs8Pk1/SV1sRgOZakt/3nTYRoLEy8e6sT9Hs4dBMTyVRCJm9h2PgB8f7j1bcAAAA=
Metadata:
aws:cdk:path: CdktestStack/CDKMetadata/Default
Parameters:
BootstrapVersion:
Type: AWS::SSM::Parameter::Value<String>
Default: /cdk-bootstrap/hnb659fds/version
Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]It also deploys successfully:
✨ Synthesis time: 4.86s
CdktestStack: start: Building 6bba642959ca71ec5f8a6a89ebfbd9da078652f88982ca360d283eeb559318ef:<ACCOUNT_ID>-us-east-2
CdktestStack: success: Built 6bba642959ca71ec5f8a6a89ebfbd9da078652f88982ca360d283eeb559318ef:<ACCOUNT_ID>-us-east-2
CdktestStack: start: Publishing 6bba642959ca71ec5f8a6a89ebfbd9da078652f88982ca360d283eeb559318ef:<ACCOUNT_ID>-us-east-2
CdktestStack: success: Published 6bba642959ca71ec5f8a6a89ebfbd9da078652f88982ca360d283eeb559318ef:<ACCOUNT_ID>-us-east-2
Stack undefined
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:
IAM Statement Changes
┌───┬───────────────────────────────┬────────┬───────────────────────┬───────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────────────┼────────┼───────────────────────┼───────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────┤
│ + │ ${someLambda.Arn} │ Allow │ lambda:InvokeFunction │ Service:lambda.alarms.cloudwatch.amazonaws.com │ "ArnLike": { │
│ │ │ │ │ │ "AWS:SourceArn": "${GenericAlarm1.Arn}" │
│ │ │ │ │ │ }, │
│ │ │ │ │ │ "StringEquals": { │
│ │ │ │ │ │ "AWS:SourceAccount": "139480602983" │
│ │ │ │ │ │ } │
│ + │ ${someLambda.Arn} │ Allow │ lambda:InvokeFunction │ Service:lambda.alarms.cloudwatch.amazonaws.com │ "ArnLike": { │
│ │ │ │ │ │ "AWS:SourceArn": "${GenericAlarm2.Arn}" │
│ │ │ │ │ │ }, │
│ │ │ │ │ │ "StringEquals": { │
│ │ │ │ │ │ "AWS:SourceAccount": "139480602983" │
│ │ │ │ │ │ } │
├───┼───────────────────────────────┼────────┼───────────────────────┼───────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────┤
│ + │ ${someLambda/ServiceRole.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │
└───┴───────────────────────────────┴────────┴───────────────────────┴───────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────────────┘
IAM Policy Changes
┌───┬───────────────────────────┬────────────────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼───────────────────────────┼────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${someLambda/ServiceRole} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole │
└───┴───────────────────────────┴────────────────────────────────────────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
Do you wish to deploy these changes (y/n)? y
CdktestStack: deploying... [1/1]
CdktestStack: creating CloudFormation changeset...
✅ CdktestStack
✨ Deployment time: 49.8s
Stack ARN:
arn:aws:cloudformation:us-east-2:<ACCOUNT_ID>:stack/CdktestStack/3beb61e0-8b24-11ef-8f60-025ea362026f
✨ Total time: 54.67sCould you try using the latest CDK version and see if the error goes away?
Thanks, Ashish
github-actions[bot]
GavinZZ
Describe the bug
The issue arises when associating multiple LambdaAction instances with a single Lambda function and different CloudWatch alarms. AWS CDK automatically creates a permission (AlarmPermission) for each alarm action associated with the Lambda function. However, if multiple alarms are associated with the same Lambda function, CDK attempts to create the same permission (e.g., AlarmPermission) multiple times, causing a conflict.
Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
AWS CDK should add unique permissions for each LambdaAction associated with the Lambda function when multiple CloudWatch alarms are configured to invoke the same Lambda.
Current Behavior
error output
The above exception was the direct cause of the following exception:
Reproduction Steps
CDK code to reproduce issue
Possible Solution
created 2 lambda aliases and assigning them to the cloud watch actions
Additional Information/Context
per this document i should be able to tie the function
https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_cloudwatch_actions/README.html
CDK CLI Version
2.151.0
Framework Version
No response
Node.js Version
v21.5.0
OS
Linux tobot-win10 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Language
Python
Language Version
3.10.12
Other information
No response