Skip to content

Conversation

@QuantumNeuralCoder
Copy link

@QuantumNeuralCoder QuantumNeuralCoder commented Mar 18, 2025

Fixes #33688
Related to #aws/aws-cdk#33689

Defaulting to deprecate feature flag createNewPoliciesWithAddToRolePolicy behavior.
features.ts
[Deprecated default feature] When this feature flag is enabled, Lambda will create new inline policies with AddToRolePolicy.
The purpose of this is to prevent lambda from creating a dependency on the Default Policy Statement.
This solves an issue where a circular dependency could occur if adding lambda to something like a Cognito Trigger, then adding the User Pool to the lambda execution role permissions.
However in the current implementation, we have removed a dependency of the lambda function on the policy. In addition to this, a Role will be attached to the Policy instead of an inline policy being attached to the role.
This will create a data race condition in the CloudFormation template because the creation of the Lambda function no longer waits for the policy to be created. Having said that, we are not deprecating the feature (we are defaulting the feature flag to false for new stacks) since this feature can still be used to get around the circular dependency issue (issue-7016) particularly in cases where the lambda resource creation doesnt need to depend on the policy resource creation.
We recommend to unset the feature flag if already set which will restore the original behavior.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@codecov-commenter
Copy link

codecov-commenter commented Mar 18, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.27%. Comparing base (fe143da) to head (e21f3e1).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #245      +/-   ##
==========================================
- Coverage   85.40%   85.27%   -0.14%     
==========================================
  Files         212      212              
  Lines       36123    36123              
  Branches     4573     4555      -18     
==========================================
- Hits        30852    30803      -49     
- Misses       5126     5170      +44     
- Partials      145      150       +5     
Flag Coverage Δ
suite.unit 85.27% <ø> (-0.14%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a copy from aws-cdk-lib, we cannot manual update it.

path=$(node -p 'require.resolve("aws-cdk-lib/recommended-feature-flags.json")')
cp $path lib/init-templates/.recommended-feature-flags.json

@github-actions github-actions bot added the p2 label Mar 18, 2025
auto-merge was automatically disabled March 18, 2025 21:53

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants