(aws-rds): adding secret rotation via SAM application fails

[thchia]

What is the problem?

When adding a secret rotation to a database (in my case, ServerlessCluster) via the .addRotationSingleUser() method, CDK deployment fails because it cannot access the S3 bucket where the rotation lambda code is stored.

The RDS method is still using the (old?) way of creating a rotation via a SAM application, and I recently updated my CDK from v1 to v2. Prior to that, it was working.

I know there was a soft intention to replace the application method of creating rotation lambdas with the hosted lambdas, but I didn't see anything about the old way being deprecated.

Reproduction Steps

    const vpc = new ec2.Vpc(this, "VPC");

    const credentials = new secrets.Secret(
      this,
      "Credentials",
      {
        generateSecretString: {
          excludePunctuation: true,
          secretStringTemplate: JSON.stringify({
            username: 'username',
          }),
          generateStringKey: "password",
        },
      }
    );

    const cluster = new rds.ServerlessCluster(this, "Database", {
      engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
      vpc,
      enableDataApi: true,
      credentials: rds.Credentials.fromSecret(credentials),
      defaultDatabaseName: "testdb",
      parameterGroup: rds.ParameterGroup.fromParameterGroupName(
        this,
        "ParameterGroup",
        "default.aurora-postgresql10"
      ),
      scaling: {
        autoPause: Duration.minutes(5),
        minCapacity: rds.AuroraCapacityUnit.ACU_2,
        maxCapacity: rds.AuroraCapacityUnit.ACU_2
      },
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
      },
    });

    cluster.addRotationSingleUser();

What did you expect to happen?

Successful deployment (in particular, creation of rotation lambda from the SAM application).

What actually happened?

Rotation Lambda failed to create, it seems I can't access the bucket with its source code.

CDK CLI Version

2.16.0

Framework Version

No response

Node.js Version

16.13.1

OS

macOS

Language

Typescript

Language Version

3.9.10

Other information

I am running the deploy command using an Administrator role, though CloudFormation is assuming the generated roles from the bootstrap: arn:aws:iam::<account id>:role/cdk-hnb659fds-cfn-exec-role-<account id>-<region>.

When I create a rotation using only the Secrets Manager construct (and use the hosted lambda properties instead of application), then it works.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.