CfnSignals not received by cloudformation although ec2 has sent them in cloudtrail.

[amrit073]

Hi , I am trying to make another resource after ec2 has completed its initialization.
I used cfnwaitcondtion to achieve this.
My ec2 is sending success event to cloudformation according to cloudtrail but cloudformation is not receiving it.
The minimal code is:

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as events from 'aws-cdk-lib/aws-events';

export class SmplDynamicStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    const vpc = new ec2.Vpc(this, "smpl-vpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.0.0.0/16"),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: "public-subnet-1",
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,
        },
      ],
    });

    //  create a security group for the EC2 instance
    const ec2InstanceSG = new ec2.SecurityGroup(this, "ec2-instance-sg", {
      vpc,
    });

    // add ingress rule to allow ssh connections to ec2
    ec2InstanceSG.addIngressRule(
      ec2.Peer.anyIpv4(),
      ec2.Port.tcp(22),
      "allow SSH connections from anywhere"
    );
    const ubuntu22LTSAMI = ec2.MachineImage.genericLinux({
      "ap-south-1": "ami-0f5ee92e2d63afc18",
    });

    const waitConditionHandle = new cdk.CfnWaitConditionHandle(this, 'waitConditionHandle')

    const waitCondition = new cdk.CfnWaitCondition(this, 'MyWaitCondition', {
      handle: waitConditionHandle.ref,
      timeout: '500',
    });

    const ec2Instance = new ec2.Instance(this, "ec2-instance", {
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PUBLIC,
      },
      securityGroup: ec2InstanceSG,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
      machineImage: ubuntu22LTSAMI,
      keyName: 'mkv',
      ssmSessionPermissions: true,
    });

    ec2Instance.addUserData(`
            sudo apt update
            sudo apt-get install -y build-essential python3-pip
            sudo pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
            cfn-signal --exit-code $? --stack ${this.stackId} --resource ${waitCondition.logicalId} --region ${this.region}
    `)

    const eventRole = new iam.Role(this, 'EventRole', {
      assumedBy: new iam.ServicePrincipal('events.amazonaws.com'),
      inlinePolicies: {
        allowRunCommand: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              actions: ['ssm:SendCommand'],
              resources: ['*'],
            }),
          ],
        }),
      },
    });

    const modifyVolumeRule = new events.CfnRule(this, 'modifyVolumeRule', {
      eventPattern: {
        source: ["aws.ec2"],
        detail: {
          event: ["modifyVolume"]
        }
      },
      roleArn: eventRole.roleArn,
      targets: [
        {
          arn: `arn:aws:ssm:${this.region}::document/AWS-RunShellScript`,
          id: '1',
          roleArn: eventRole.roleArn,
          input: JSON.stringify({
            commands: [`resize2fs /dev/xvdf`],
          }),
          runCommandParameters: {
            runCommandTargets: [{ key: "instanceids", values: [ec2Instance.instanceId] }]
          }
        }
      ]
    })

    modifyVolumeRule.addDependency(waitCondition);
  }
}

[amrit073]

it turns out that in eventPattern, it should be 'eventName', not 'event' and 'ModifyVolume'. Look into Event trail json before making a eventPattern.

     eventPattern: {
       "source": ["aws.ec2"],
       "detail": {
         "eventName": ["ModifyVolume"]
       }
     },

Also, script from https://gist.githubusercontent.com/weavenet/5815644/raw/fd283f614cad86abe41cccfc3e7b79eb1b613741/cfn-signal.sh can be used to send signal without installing cloud cfn signals package in ec2 machine.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.