Closed DanielSchiavini closed 1 year ago
DanielSchiavini
commented
1 year ago OK I have now managed to apply the update after running pulumi refresh. It seems the resource was changed directly in AWS and that caused the crash on the Pulumi provider.
mikhailshilkov
commented
1 year ago @DanielSchiavini Do you know which attributes were changed in AWS? Or any other concrete steps that I could you to reproduce the issue locally?
DanielSchiavini
commented
1 year ago @mikhailshilkov the following rule had been added to AWS and then "backported" to pulumi:
{
byteMatchStatement: {
searchString: "/api/v1/account",
fieldToMatch: { uriPath: {} },
textTransformations: [
{
priority: 0,
type: "NONE"
}
],
positionalConstraint: "CONTAINS"
}
},@DanielSchiavini Thank you! One more question - which pulumi-aws version are you on? pulumi about somehow did not print that info.
DanielSchiavini
commented
1 year ago These are my dependencies
"dependencies": {
"@pulumi/aws": "^6.2.1",
"@pulumi/awsx": "^1.0.5",
"@pulumi/github": "^5.19.0",
"@pulumi/mongodbatlas": "^3.10.1",
"@pulumi/pulumi": "^3.85.0",
"@pulumi/random": "^4.14.0"
}
lukehoban
commented
1 year ago A few questions:
DanielSchiavini
commented
1 year ago
"node_modules/@pulumi/aws": {
"version": "6.0.4",
"resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-6.0.4.tgz",
"integrity": "sha512-g8t+LuKwEEGX7bKUcYpB8gr1xtrJm3PAt26Js5QztSWDiujy9ehmk4CeEgKLfMR9EGmav6jFSSvwX5IQXSPgog==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/pulumi": "^3.0.0",
"builtin-modules": "3.0.0",
"mime": "^2.0.0",
"read-package-tree": "^5.2.1",
"resolve": "^1.7.1"
}
},
"node_modules/@pulumi/awsx": {
"version": "1.0.5",
"resolved": "https://registry.npmjs.org/@pulumi/awsx/-/awsx-1.0.5.tgz",
"integrity": "sha512-iGkDzPalPhzRlfqCaWgwJkaA8EfgPwzWkcqdg0TgcnUefNwKGEXfEelORxMXKxZe5M0VV3U3ljrEq6P0SLCtWg==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/aws": "^5.35.0",
"@pulumi/docker": "^3.6.1",
"@pulumi/pulumi": "^3.0.0",
"@types/aws-lambda": "^8.10.23",
"mime": "^2.0.0"
}
},
"node_modules/@pulumi/awsx/node_modules/@pulumi/aws": {
"version": "5.42.0",
"resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-5.42.0.tgz",
"integrity": "sha512-1h7Q5DjwoWVGxhBMcNragx/Q1US1KT7g29Tk3RghTg/9N7rGUbzTQKEXSrGgRSjGA/aKTbU+gt5A9ZmhONLiLg==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/pulumi": "^3.0.0",
"aws-sdk": "^2.0.0",
"builtin-modules": "3.0.0",
"mime": "^2.0.0",
"read-package-tree": "^5.2.1",
"resolve": "^1.7.1"
}
},
t0yv0
commented
1 year ago Unfortunately I cannot reproduce this. Judging by the stack trace it is a panic in the tags interceptor due to an unexpected nil in GetRawPlan:
I'm not sure how refresh fixed this, because it seems it should be happening during planning an Update before hitting up the cloud. I've tried running a few variations of the program through an Update on the listed versions, no repro.
We did historically have issues with panics in GetRawPlan, fixed since v3.45.0 of the terraform bridge framework used in this provider but it seems the stack trace is referencing a newer v3.58.0 version.
new wafv2.WebAcl('firewall', {
name: 'firewall',
description: 'Blocks IPs if they do too many requests per minute.',
defaultAction: { allow: {} },
rules: [
{
name: "rate-limit",
priority: 0,
rateBasedStatement: {
limit: 2000,
aggregateKeyType: "IP"
}
},
action: {
block: {
customResponse: {
responseCode: 429,
//customResponseBodyKey: "rate-limit-response"
}
}
},
visibilityConfig: {
sampledRequestsEnabled: true,
cloudwatchMetricsEnabled: true,
metricName: "rate-limit"
}
},
{
name: "account-creation-rate-limit",
priority: 1,
statement: {
rateBasedStatement: {
limit: 200,
aggregateKeyType: "IP",
scopeDownStatement: {
andStatement: {
statements: [
{
byteMatchStatement: {
searchString: "/api/v1/account",
fieldToMatch: { uriPath: {} },
textTransformations: [
{
priority: 0,
type: "NONE"
}
],
positionalConstraint: "CONTAINS"
}
},
{
notStatement: {
statements: [{
byteMatchStatement: {
searchString: "GET",
fieldToMatch: {
method: {}
},
textTransformations: [
{
priority: 0,
type: "NONE"
}
],
positionalConstraint: "EXACTLY"
}
}]
}
}
]
}
}
}
},
action: {
block: {
customResponse: {
responseCode: 429,
//customResponseBodyKey: "rate-limit-response"
}
}
},
visibilityConfig: {
sampledRequestsEnabled: true,
cloudwatchMetricsEnabled: true,
metricName: "account-creation-rate-limit"
}
}
],
visibilityConfig: { sampledRequestsEnabled: true, cloudwatchMetricsEnabled: true, metricName: 'firewall' },
customResponseBodies: [{
key: `firewall-rate-limit-response`,
content: 'Too many requests, please try again later.',
contentType: 'TEXT_PLAIN',
}],
scope: 'REGIONAL',
});
I've tried harder here testing a few upgrade scenarios along these lines and tracing the place where this panic is received, but still wasn't able to reproduce.
pulumi destroy --yes
npm i @pulumi/aws@5.42.0 # tested 5.29.0
pulumi up --yes --skip-preview
npm i @pulumi/aws@6.0.4
pulumi up --yes --skip-previewVerbose logs or a repro would be extremely valuable here.
DanielSchiavini
commented
1 year ago Sorry, I also cannot reproduce the issue anymore. Thanks for all your effort.
mikhailshilkov
commented
1 year ago Closing for now... please let us know if the issue still occurs.
What happened?
When trying to apply updates, the following error is received:
Example
This is the code that raises the error:
Output of
pulumi aboutAdditional context
When downloading the JSON from the AWS console, the
andStatementseems to expect a singlestatement, but Pulumi requires a list ofstatementsContributing
Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).