(servicecatalog): ProductStackHistory changes last product version ID

[konokenj]

Describe the bug

ProductStackHistory is expected to keep older product versions as-is for consistency. But currently, the ID of last deployed product version changes by adding new version.
This becomes a blocker for users of Account Factory Customization (AFC) in AWS Control Tower because users may lost product version id that is used by AFC blueprint.

Expected Behavior

Product version IDs should be immutable when adding a new version with currentVersionLocked: true.

Current Behavior

The ID of last deployed product version changes by adding new version.

Reproduction Steps

Deploy v1

import { App, Stack } from 'aws-cdk-lib';
import { CloudFormationProduct, ProductStack, ProductStackHistory } from 'aws-cdk-lib/aws-servicecatalog';
import { Construct } from 'constructs';
import { Queue } from 'aws-cdk-lib/aws-sqs';

const app = new App();
const stack = new Stack(app, "ServiceCatalog")

class MyProduct extends ProductStack {
  constructor(scope: Construct, id: string) {
    super(scope, id);
    new Queue(this, "SCQueue1")
  }
}

const productStackHistory = new ProductStackHistory(stack, 'ProductStackHistory', {
  productStack: new MyProduct(stack, 'MyProduct'),
  currentVersionName: 'v1',
  currentVersionLocked: true,
});

new CloudFormationProduct(stack, 'Product', {
  productName: 'MyProduct',
  owner: 'Platform team at Example Company',
  productVersions: [
    productStackHistory.currentVersion(),
  ],
});

Deploy v2 with no changes in ProductStack

@@ -15,7 +15,7 @@ class MyProduct extends ProductStack {

 const productStackHistory = new ProductStackHistory(stack, 'ProductStackHistor>
   productStack: new MyProduct(stack, 'MyProduct'),
-  currentVersionName: 'v1',
+  currentVersionName: 'v2',
   currentVersionLocked: true,
 });

@@ -23,7 +23,7 @@ new CloudFormationProduct(stack, 'Product', {
   productName: 'MyProduct',
   owner: 'Platform team at Example Company',
   productVersions: [
-    // productStackHistory.versionFromSnapshot("v1"),
+    productStackHistory.versionFromSnapshot("v1"),
     productStackHistory.currentVersion(),
   ],
 });

cdk diff

Result of deployment

Deploy v3 with changes in ProductStack

@@ -9,13 +9,13 @@ const stack = new Stack(app, "ServiceCatalog")
 class MyProduct extends ProductStack {
   constructor(scope: Construct, id: string) {
     super(scope, id);
-    new Queue(this, "SCQueue1")
+    new Queue(this, "SCQueue3")
   }
 }

 const productStackHistory = new ProductStackHistory(stack, 'ProductStackHistor>
   productStack: new MyProduct(stack, 'MyProduct'),
-  currentVersionName: 'v2',
+  currentVersionName: 'v3',
   currentVersionLocked: true,
 });

@@ -24,6 +24,7 @@ new CloudFormationProduct(stack, 'Product', {
   owner: 'Platform team at Example Company',
   productVersions: [
     productStackHistory.versionFromSnapshot("v1"),
+    productStackHistory.versionFromSnapshot("v2"),
     productStackHistory.currentVersion(),
   ],
 });

cdk diff

Result of deployment

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.68.0 (build 25fda51)

Framework Version

2.68.0

Node.js Version

v18.13.0

OS

macOS Monterey 12.6.3

Language

Typescript

Language Version

4.9.5

Other information

No response

[pahud]

Awesome details!!! Thank you Kenji san! Are you interested to submit your PR for this?

[konokenj]

Yes, but I haven't come up with a good solution yet.
I think we have to keep S3 object path of the asset and product version name that once deployed. Or we have to use snapshot file that written to disk also in currentVersion(). Further investigation is needed.
Please let me know if you have a good idea.

[wanjacki]

Hey @konokenj we (Service Catalog) will add an item to our backlog to investigate and hopefully fix this!

[HFR1994]

Any updates?

[1001R]

I've run into the same issue and may have identified the cause: the way the asset hash for the generated product template differs between the current version (product stack synthesized in memory and hashed) and snapshot versions (using FileSystem.fingerprint on the template written to disk). The moment you add a new version, for latest version will be created as a snapshot version, the asset hash changes (although it's essentially the same template), which in turn results in a different template URL.

I submitted a PR to fix this, but as this is my first contribution I've haven't been able to update the integration tests. Maybe someone could help me with this?