Aws-cdk: Incompatible tags definition for AWS::Athena::WorkGroup

[udondan]

Currently it is not possible to create an AWS::Athena::WorkGroup due to the way tags are defined.

The WorkGroup resource expects tags to be a list of objects. The definition in the autogenerated code though has another level. Something like:

"Tags": {
  "Tags": [{
    "key": "a",
    "value": "b"
  }]
}

Even if no tags are set for the resource, the generated template holds an empty object:

"Tags": {},

This format is not supported and CloudFormation fails with an Internal Failure.

Reproduction Steps

This code compiles. Note the nested tags definition.

    new athena.CfnWorkGroup(scope, 'Athena-Workgroup', {
        name: 'HelloWorld',
        description: 'A WorkGroup,
        recursiveDeleteOption: true,
        state: 'ENABLED',
        tags: {
            tags: [{
                key: 'a',
                value: 'b',
            }]
        },
        workGroupConfiguration: {
            requesterPaysEnabled: true,
            resultConfiguration: {
                outputLocation: `s3://${bucket.bucketName}/athena/results/`,
                encryptionConfiguration: {
                    encryptionOption: 'CSE_KMS',
                    kmsKey: key.keyArn,
                },
            },
        }
    });

If you remove the outer tags, it won't compile.

If you remove the whole tags definition it again compiles, but fails to create the resource due to the unexpected default value of {}.

Error Log

Internal Failure ;-)

Environment

All of them

Other

I wanted to go ahead and fix the problem myself but since this is part of the autogenerated code which even seems to be not in the repo, I wouldn't know how.

---

This is :bug: Bug Report

[l8on]

I have run into the same issue.

Thanks to this report, I was able I work around it by using one of the "Escape Hatches":

export class WorkAroundGroup extends CfnWorkGroup {
  constructor(scope: Construct, id: string, props?: CfnWorkGroupProps) {
    super(scope, id, props);
    // Work around issue with the way Tags are encoded
    // Tags needs to be a non-empty array, but the default CfnWorkGroup creates an empty object `{}`
    // This empty object fails the request
    this.addPropertyOverride('Tags', [{ key: 'foo', value: 'bar', }]);
  }
}

[udondan]

I love the name of your class 😂

[iliapolo]

@udondan Interesting, since the code you are using is auto-generated, it implies either a bug in the CloudFormation spec, or in our code generator.

The documented CFN spec seems correct: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-tags.html

We will take a look. Thanks for reporting this!

[blimmer]

I also ran into this today. Instead of creating a new construct, I just did it in inline.

const workgroup = new athena.CfnWorkGroup(this, "AthenaWorkGroup", {
  name: "my-workgroup",
  description: "my real description goes here",
});
// Workaround for a cdk bug. We can remove this when this issue is resolved:
// https://github.com/aws/aws-cdk/issues/6936
workgroup.addPropertyOverride("Tags", [{ key: "foo", value: "bar" }]);

[udondan]

@l8on @blimmer Is this still working for you? I just came back to my Athena project and now this seems to be broken beyond fix via overrides. I'm getting

Model validation failed (... expected type: Boolean, found: String

For RecursiveDeleteOption and RequesterPaysEnabled. The template for sure contains booleans, so there is nothing to override. Even when those are not set, RecursiveDeleteOption is automatically set to true.

[blimmer]

The tags override I described in this post is still working for me as of 1.47.1.

[udondan]

@iliapolo I checked the CFN spec and indeeed it is wrong.

It should be

    "AWS::Athena::WorkGroup.Tags": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-tags.html#cfn-athena-workgroup-tags-tags",
      "UpdateType": "Mutable",
      "Required": false,
      "Type": "List",
          "ItemType": "Tag"
    },

instead of

    "AWS::Athena::WorkGroup.Tags": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-tags.html",
      "Properties": {
        "Tags": {
          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-tags.html#cfn-athena-workgroup-tags-tags",
          "UpdateType": "Mutable",
          "Required": false,
          "Type": "List",
          "ItemType": "Tag"
        }
      }
    },

Nothing wrong with the generator.

[moofish32]

@SomayaB or @iliapolo is there an update about when the spec will be corrected? If not I can modify the generator for this exception case. @rix0rrr remember when we had the idea of "patching" the cfn spec? Sometimes I wish we still had that.

[iliapolo]

@moofish32 You mean this sort of patching? https://github.com/aws/aws-cdk/commit/b59aed01c2a7a6ddcac1cd6530f0603707594a9c#diff-cf42064b222db2a3e52591d8d39203b0

We still do that from time to time, would you like to have a go at it?

[moofish32]

yep -- let me take a look.