How to modify CfnParameter for objects inside the stack

[Cameronsplaze]

We have a CfnParameter that's the prefix for the stack that we use in multiple places (i.e PROD). The problem is using it in a s3 bucket name will throw, since upper-case characters aren't allowed in s3 bucket names.

We could use a Map, but would like it to be more dynamic than that. (Feature/devel stacks could have all sorts of prefixes).

Another idea was to use Lazy Tokens, but they don't populate by then either:

from aws_cdk import (
    Stack,
    Token,
    CfnParameter,
    RemovalPolicy,
    Lazy,
    IStringProducer,
    aws_s3 as s3,
)
from constructs import Construct
import jsii

class CfnparameterTestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.bucket_prefix = CfnParameter(self, "testing", type="String", default="AsDf")
        
        hello_bucket = s3.Bucket(
            self, 'HelloBucket',
            bucket_name=Lazy.string(Producer(self.bucket_prefix)),
            versioned=False,
            public_read_access=False,
            removal_policy=RemovalPolicy.DESTROY,
        )

@jsii.implements(IStringProducer)
class Producer:
    def __init__(self, output):
        self.output = output
    def produce(self, context):
        # Token is unresolved still, so this will return None. If you remove this
        #   check though, deployment throws since ${Token[TOKEN.15]} isn't valid
        if Token.is_unresolved(self.output):
            return None
        return f"{self.output.value_as_string}-cdk-testing".lower()

Similar to aws/jsii#807

The token isn't resolved yet, so the above will always return None. Since this is something we pass into the stack, it seems really weird it can't be accessed until after the stack is deploying.

Another option is to use Fn.transform:

class CfnparameterTestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.bucket_prefix = CfnParameter(self, "testing", type="String", default="AsDf")
        self.bucket_lower = Fn.transform( "String", {
                "Operation": "Lower",
                "InputString": self.bucket_prefix.value_as_string
            }
        ).to_string()

        hello_bucket = s3.Bucket(
            self, 'HelloBucket',
            bucket_name=self.bucket_lower,
            versioned=False,
            public_read_access=False,
            removal_policy=RemovalPolicy.DESTROY,
        )

But this requires you to deploy the 'String" macro to your account first. Plus that's a LOT of code for a single .lower() operation, it won't scale well.

My final thought is to use --context instead. I'd really like to have the Cloudformation Console populated with the input params still though, so maybe I can create the CfnParams from context directly, then never touch them again? Then I can call the .lower()/etc operations on the context values themselves. My initial hunch is its hacky, so I wonder if there's a simpler solution I'm missing.

Thanks!

[Cameronsplaze]

This is the best thing we've come up with so far: Create CfnParameter for visibility but don't use it directly.

# you can also have the default be in cdk.json, this is just for an example
def get_param(stack: Stack, key: str, default: str=None, param_type: str="String", description: str="") -> str:
    val = self.node.try_get_context(key) or default
    # If you don't pass in a default, make it a required variable:
    if val is None:
        raise ValueError(f"Missing required parameter: '{key}', and no default is set.")
    # This is just to see what the stack was deployed with in the console/cfn-parameters tab:
    CfnParameter(
        stack,
        key, 
        type=param_type,
        default=val,
        # Since changing it in the console won't do anything, don't let them:
        allowed_values=[val],
        description=f"{description}{' ' if description else ''}(Re-deploy to Edit)"
    )
    # If you're expecting a number, change it away from a string:
    #   (CfnParameter *wants* the input as a string, but nothing else does)
    if param_type == "Number":
        val = float(val) if "." in val else int(val)
    return val

class CfnparameterTestStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.maturity = get_param(self, "maturity", "TEST")

        hello_bucket = s3.Bucket(
            self, 'HelloBucket',
            bucket_name=f"{self.maturity.lower()}-hello-bucket",
            versioned=False,
            public_read_access=False,
            removal_policy=RemovalPolicy.DESTROY,
        )

Deploy with: cdk deploy --context maturity=dev --no-previous-parameters (no-prev-params required to update the params from scratch, otherwise updates won't show the new param, AND allowed_values of the first deployment would block the rest).

The main cons I see are:

• You can't change the param values in the console (If you tried, it'd do nothing. The stacks are using the string directly, NOT the token)
• You have to be clear to deploy with --context maturity=whatever. If you tired --parameter maturity=foo, things would not work.

And the main pros:

• Just update params by re-deploying the stack (easy with github actions + workflow_dispatch)
• Still have viability into what the stack was deployed with in the console.
• Modify the input params if needed for specific stack objects (bucket_name=f"{self.maturity.lower()}-hello-bucket")

Any thoughts?

[caretak3r]

This only works if you know what the CfnParameter values are beforehand right? But if the values are unknown, and the user selects values or inputs values at deploy time, this doesn't work?

[Cameronsplaze]

@caretak3r I'm not sure what you mean with values being unknown, could you provide an example? Above should work by passing them in as you run "cdk deploy --context ...."

[caretak3r]

Suppose we have a cdk app that creates a template, call it eks-template.json. a user uploads the cloudformation template to their AWS account via the console. The template will deploy EKS in an existing VPC, using existing subnets. The user selects those values at deploy-time, up until which the values are unknown for the CDK app to use.

I tried to test using sample vpc id and subnet values as a test, but I am unable to figure out how to use CfnParameters and still be able to render a template.

[Cameronsplaze]

The user selects those values at deploy-time, up until which the values are unknown for the CDK app to use.

I haven't tried this workflow before, so I'm not 100% sure, but I'm guessing this is the equivalent of passing in --parameter * to the "cdk deploy" command. That's one of the cons I listed since it works with tokens, and you can't modify those easily. I found a way around it by saving what the variable is before hand, and returning that after creating the CfnParameters. If there's a way to set either --context (which you can also do in cdk.json), or set environment variables and grab those instead, this might work for your use-case too?

Above is made for deploying apps with the CLI, where both of those things are available.

[singlewind]

I have no issue to pass --parameters in to included cloudformation. However, cdk diff doesn't have it which will always fallback to no change-set diff. The idea is try to avoid any re-creating resources to import existing deployed cloudformation stack to CDK stack.