CfnTagAssociation: Multiple resources created by Synth

[whatnick]

Describe the bug

Adding LakeFormation Tags via Python CDK to Glue Tables results in this error : Resource parameter must have exactly 1 resource specified but 2 were provided.

Expected Behavior

Tags are assigned correctly when CDK synthesizes the underlying cloudformation resource.

Current Behavior

Cloudformation Resource is synthesized with duplicate resources being attached to the LakeFormation TAG leading to failure in deployment.

Reproduction Steps

Create a tag association in a Stack using code similar to this. This results in a synthesized resource with 2 resources in the TAG which fails to deploy.

association = CfnTagAssociation(
self,
f"{tag}TagAssociation",
lf_tags=[
CfnTagAssociation.LFTagPairProperty(
catalog_id=Aws.ACCOUNT_ID,
tag_key=f"{namespace}-{tag}",
tag_values=[tag_value],
)
],
resource=CfnTagAssociation.ResourceProperty(
catalog={},
table=CfnTagAssociation.TableResourceProperty(
catalog_id=Aws.ACCOUNT_ID,
name=table_name,
database_name=database.database_name,
),
),
)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.136.0 (build 94fd33b)

Framework Version

No response

Node.js Version

v18.14.2

OS

Ubuntu 22.04

Language

Python

Language Version

3.9.18

Other information

No response

[danielfordfc]

Is there a workaround for this at all? Our tooling is currently susceptible to this issue @whatnick @khushail

[whatnick]

My solution so far has been to remove and re-add the tag. Mutating the tag causes the above issue.

[whatnick]

Just noting that with this bug, creating new tables with Tags fails as well now.

[khushail]

Thanks for reporting this @whatnick . Checking the API docs, its not clear as what might be causing the error. Please create an issue with Cloudformation coverage roadmap or try reaching out to Cloudformation team through AWS Premium Support.

[whatnick]

So the error seems to stem from both catalog and table keys being specified in the synthesized Cfn template from the sample code. The API from cloudformation creating the resource in Lake Formation cannot handle that specification after a given update and the whole thing gets stuck if there is an old template with the extra catalog entry there.

"Resource": {
          "Catalog": {},
          "Table": {
            "CatalogId": {
              "Ref": "AWS::AccountId"
            },
            "DatabaseName": {
              "Ref": "SomeDB"
            },
            "Name": "some-table-name"
          }
        }

The solution is to :

• Clean up all tags by updating the Template. Using retain on the underlying resource if the tags are in live use for security purposes in an underlying system.
• Create new TagAssociations with only one Catalog, Table or Database resource. Previous CloudFormation allowed multiple resources to be specified and this is now tangled and needs manual untangling.

From a CDK perspective, I can suggest that Synth fails if :

• Multiple items are speficied in the resource.
• Any nulls like an empty catalog dict are dropped to avoid confusion at the CloudFormation end.