(iam): cdk synth Throws Error When Adding SQS Event Source to Imported Lambda Function

[bravemav]

cdk synth throws an error when addEventSource is used to add an SQS event source on an imported lambda function.

Reproduction Steps

import * as cdk from '@aws-cdk/core';
import {Fn} from "@aws-cdk/core";
import * as sqs from '@aws-cdk/aws-sqs';
import * as lambda from "@aws-cdk/aws-lambda";
import {SqsEventSource} from "@aws-cdk/aws-lambda-event-sources";

export class CdkLambdaImportErrorStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const importedFunction = lambda.Function.fromFunctionArn(this, 'imported-function', 'imported-lambda-function-arn');
    const queue = new sqs.Queue(this, 'queue');
    importedFunction.addEventSource(new SqsEventSource(queue));
  }
}

What did you expect to happen?

cdk synth succeeds when an SQS event source is added to an imported lambda function.

What actually happened?

The following error occurred while calling cdk synth

Error: Cannot get policy fragment of CdkLambdaImportErrorStack/imported-function, resource imported without a role

Environment

• CDK CLI Version : 1.85.0
• Framework Version:
• Node.js Version: v12.20.1
• OS : macOS Big Sur 11.1
• Language (Version): TypeScript 3.9.7

Other

Related issue: #4613
The above referenced issue fixed a similar issue with the same error message but as part of the CodeBuild module. Maybe this issue has the same underlying root cause and a similar fix?

Stack trace for this issue:

Error: Cannot get policy fragment of CdkLambdaImportErrorStack/product-search-function, resource imported without a role
    at UnknownPrincipal.get policyFragment [as policyFragment] (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-iam/lib/unknown-principal.ts:38:11)
    at PolicyStatement.addPrincipals (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-iam/lib/policy-statement.ts:141:34)
    at new PolicyStatement (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-iam/lib/policy-statement.ts:76:10)
    at Function.addToPrincipalOrResource (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-iam/lib/grant.ts:141:23)
    at Queue.grant (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-sqs/lib/queue-base.ts:241:22)
    at Queue.grantConsumeMessages (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-sqs/lib/queue-base.ts:177:22)
    at SqsEventSource.bind (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-lambda-event-sources/lib/sqs.ts:45:16)
    at Import.addEventSource (/Users/computer/dev/cdk-lambda-import-error/node_modules/@aws-cdk/aws-lambda/lib/function-base.ts:344:12)
    at new CdkLambdaImportErrorStack (/Users/computer/dev/cdk-lambda-import-error/lib/cdk-lambda-import-error-stack.ts:14:27)
    at Object.<anonymous> (/Users/computer/dev/cdk-lambda-import-error/bin/cdk-lambda-import-error.ts:7:1)

---

This is 🐛 Bug Report

[shahbour]

Same result when trying to add to DynamoEventSource

[nija-at]

This seems to a bug in the grant APIs. Transferring to IAM.

[filipsuk]

Please is there a workaround for this? Maybe using Cfn resources?

EDIT: I think this can be used https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-lambda.EventSourceMapping.html. But it probably requires to manually update the lambda exection role:

The SqsEventSource class will automatically create the mapping, and will also modify the Lambda's execution role so it can consume messages from the queue.

[eladb]

@rix0rrr can you propose a workaround until this is resolved?

[rix0rrr]

I would have to dive into the specifics, but you can try using fromFunctionAttributes() and passing in a placeholder object for role.

That feels like it should do it.

[filipsuk]

I found an example in other issue #10342 (comment)

const myFn = lambda.Function.fromFunctionArn(this, 'function', {
  functionArn: 'function-arn',
  role: iam.Role.fromRoleArn(this, 'role', 'role-arn'),
});

But it sucks you need to know the execution role arn :/

[argenstijn]

Using the role arn to fetch the role of the function is really nasty. Because the role is mostly a generated value .

Would be must helpful if the role is just retrieved along with the function.

[pnedelko]

Is it already fixed or planned to be fixed?

[modul]

any updates on this?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.