S3 LambdaDestination creates a cyclic reference

[rinfield]

Setting S3 Bucket notification to a Lambda function in the other stack creates a cyclic reference.

Reproduction Steps

import * as cdk from "@aws-cdk/core";
import * as lambda from "@aws-cdk/aws-lambda";
import * as s3 from "@aws-cdk/aws-s3";
import * as s3n from "@aws-cdk/aws-s3-notifications";

const app = new cdk.App();
const stack1 = new cdk.Stack(app, "stack1");
const stack2 = new cdk.Stack(app, "stack2");

const lambdaFunction = new lambda.Function(stack1, "lambdaFunction", {
  code: lambda.Code.fromInline("whatever"),
  handler: "index.handler",
  runtime: lambda.Runtime.NODEJS_10_X
});

const bucket = new s3.Bucket(stack2, "bucket");
bucket.addObjectCreatedNotification(new s3n.LambdaDestination(lambdaFunction));

$ cdk synth

Error Log

/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/stack.ts:639
        throw new Error(`'${target.node.path}' depends on '${this.node.path}' (${cycle.join(', ')}). Adding this dependency (${reason}) would create a cyclic reference.`);
              ^
Error: 'stack2' depends on 'stack1' (stack2 -> stack1/lambdaFunction/Resource.Arn, "stack2/bucket/Notifications/Resource" depends on "stack1/lambdaFunction/AllowBucketNotificationsFromstack2bucketA161360C"). Adding this dependency (stack1 -> stack2/bucket/Resource.Arn) would create a cyclic reference.
    at Stack._addAssemblyDependency (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/stack.ts:639:15)
    at Object.addDependency (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/deps.ts:44:20)
    at Stack.addDependency (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/stack.ts:343:5)
    at Stack.prepareCrossReference (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/stack.ts:906:24)
    at Stack.prepare (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/stack.ts:749:37)
    at Function.prepare (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/construct.ts:81:28)
    at Function.synth (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/construct.ts:40:10)
    at App.synth (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/app.ts:141:36)
    at process.<anonymous> (/workspaces/cdk-sample/node_modules/@aws-cdk/core/lib/app.ts:120:45)
    at Object.onceWrapper (events.js:300:26)

Environment

• CLI Version : 1.20.0
• Framework Version: 1.20.0
• OS : All
• Language : TypeScript

Other

The resources for the notification seem to have been attached to the stack for Lambda Function and it is causing cyclic reference. Instead, it should be attached to the stack for S3 Bucket.

Passing explicit scope at fn.addPermission() would solve the problem, but I'm not sure it is an appropriate fix or not.

• https://github.com/aws/aws-cdk/blob/v1.20.0/packages/@aws-cdk/aws-s3-notifications/lib/lambda.ts#L17-L21
• https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-lambda.Permission.html

---

This is 🐛 Bug Report

[SomayaB]

Hi @rinfield, thanks for reporting this. We will update this issue when there is movement.

[muellerk22]

I'm having the same issue. Is there a work around?

[patbassing]

I too am having this issue. I haven't been able to find any work around, other than creating bucket and function in the same stack.
+1 from me.

[civilizeddev]

+1
I'm having the same issue when using SqsDestination.

[aleskozina]

+1
same here

[comsky]

+1
same here
CDK 1.62

[aleskozina]

anyone tested if this happens in nestedStack too?

[jmfiola]

+1

[jappyjan]

same here

[miekassu]

Looks like this is still an issue!

Cyclic dependency error as described in issue description.
CDK Version 2.8.0.

This relates to #11245.
I did workaround using this solution #11245 (comment)

[ShivamJoker]

Hello any updates? why is it closed?

[gfteix]

One possible workaround is to use AwsCustomResource. You basically specify an AWS SDK call to be executed onCreate, onUpdate or onDelete - internally this creates a Lambda that will do the real work:
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.custom_resources-readme.html#custom-resources-for-aws-apis

Note: This replaces the existing notification configuration with the configuration you include in the parameter. Check: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotificationConfiguration.html

lambda.addPermission(`AllowS3Invocation`, {
    action: 'lambda:InvokeFunction',
    principal: new ServicePrincipal('s3.amazonaws.com'),
    sourceArn: bucket.bucketArn
  })

  const notificationResource = new AwsCustomResource(this, `NotificationCustomResource`, {
    logRetention: RetentionDays.THREE_DAYS,
    policy: AwsCustomResourcePolicy.fromStatements([
      new PolicyStatement({
        effect: Effect.ALLOW,
        actions: ['s3:PutBucketNotification'],
        resources: [bucket.bucketArn, `${ bucket.bucketArn }/*`],
      })
    ]),
    onCreate: {
      service: 'S3',
      action: 'putBucketNotificationConfiguration',
      parameters: {
        Bucket: bucket.bucketName,
        NotificationConfiguration: {
          LambdaFunctionConfigurations: [
            {
              Events:['s3:ObjectCreated:*'],
              LambdaFunctionArn: lambda.functionArn,
            }
          ]
        }
      },
      physicalResourceId: PhysicalResourceId.of(`${ id + Date.now().toString() }`),
    },
  })

  notificationResource.node.addDependency(lambda.permissionsNode.findChild('AllowS3Invocation')

[MatthewMSaucedo]

+1 - this is still an issue.

[Brody8TY]

+1 - still an issue

[kellan-cartledge]

+1 - this is still an issue.

[HaydenFaulkner]

+1

[tejad]

+1