how were bucket notifications added to an imported bucket

[whitney]

Overview

• bucket notifications stopped working in one of our environments.
• they had been working
• via AWS console I noticed that the bucket had no event notifications associated with it
• I also noticed that the way the event notifications were declared in our CDK application was via a stack that was imported
• I moved them to the stack that defined the bucket and they were recreated
• how is this possible?

Details

• bucket is defined in stack A
• notifications were defined in stack B
• both stacks A and B were part of the same CDK app
• bucket imported into stack B via e.g.

bucket = s3.Bucket.from_bucket_arn(self,...)

• events declared in stack B via e.g.

bucket.add_event_notification(
    s3.EventType.OBJECT_CREATED,
    s3n.SnsDestination(sns_topic),
    s3.NotificationKeyFilter(
        prefix="some-prefix/",
    ),
)

• this ^^ runs for some time with notifications working

So the question is: how is this possible? How did this possibly ever work? I am aware of:

Although you can use an external resource anywhere you'd use a similar resource defined in your AWS CDK app, you cannot modify it. For example, calling addToResourcePolicy (Python: add_to_resource_policy) on an external s3.Bucket does nothing.

via https://docs.aws.amazon.com/cdk/v2/guide/resources.html#resources_importing

[peterwoodworth]

Although you can use an external resource anywhere you'd use a similar resource defined in your AWS CDK app, you cannot modify it. For example, calling addToResourcePolicy (Python: add_to_resource_policy) on an external s3.Bucket does nothing.

This is misleading, but true most of the time. There are some cases where the resource can be modified, and this is one of those cases. The reason you normally can't modify external resources is because we aren't able to modify the CloudFormation template definition for them. However, that's not the only way to interact with AWS of course. addEventNotification specifically makes use of a custom resource that makes SDK calls during CloudFormation deployment. You can find the handler for that here.

Looking at it, and rereading your description of the issue, I'm not super sure why this would cause any issues. It sounds like it was working, then suddenly it wasn't? Can you provide more details on that and if you made any changes between when it started and stopped working?