(aws-s3-notifications): How to add event notification to existing bucket using existing role?

[timotk]

❓ General Issue

How to add event notification to existing bucket using existing role?

I would like to add a S3 event notification to an existing bucket that triggers a lambda. As describe here, this process will create a BucketNotificationsHandler lambda. However, I am not allowed to create this lambda, since I do not have the permissions to create a role for it:

<me> is not authorized to
perform: iam:CreateRole on resource: arn:aws:iam::<account>:role/<prefix>-BucketNotificationsHandler...

Is there a way to work around this? I am not in control of the full AWS stack, so I cannot simply give myself the appropriate permission. I am allowed to pass an existing role.

Here's a slimmed down version of the code I am using:

project_iam_role = aws_iam.Role.from_role_arn(
    self,
    id="myrole",
    role_arn="arn:aws:iam::<account>:role/<myrole>",     
    mutable=False,
)


bucket = aws_s3.Bucket.from_bucket_name(
    self, id="bucket", bucket_name="mybucket"
)

trigger_function = aws_lambda.Function(...)

bucket.add_event_notification(
                    aws_s3.EventType.OBJECT_CREATED,
                    aws_s3_notifications.LambdaDestination(trigger_function),
)

(Partial) output of cdk diff:

[+] AWS::IAM::Role BucketNotificationsHandler.../Role BucketNotificationsHandler050....
[+] AWS::IAM::Policy BucketNotificationsHandler.../Role/DefaultPolicy BucketNotificationsHandler050...RoleDefaultPolicy....
[+] AWS::Lambda::Function BucketNotificationsHandler....BucketNotificationsHandler...

Final error:

9:19:26 AM | CREATE_FAILED        | AWS::IAM::Role                | BucketNotification...
API: iam:CreateRole User: arn:aws:sts::<account>:assumed-role/<myrole>/<my-email> is not authorized to
perform: iam:CreateRole on resource: arn:aws:iam::<account>:<myyrole>/....BucketNotificationsHandl-...

Environment

• CDK CLI Version: 1.117.0
• Module Version: 1.119.0
• Node.js Version: v16.6.2
• OS: macOS Big Sur
• Language (Version): Python 3.8

Other information

related isssues:

• [S3] add event notification creates BucketNotificationsHandler lambda #9890
• [aws-s3-notifications] add_event_notification creates Lambda AND SNS Event Notifications #9552

[otaviomacedo]

At the moment, there is no way to pass your own role to create BucketNotificationsHandler. And I don't even know how we could change the current API to accommodate this. It wouldn't make sense, for example, to add an IRole to the signature of addEventNotification.

What you can do, however, is create your own custom resource (copied from the CDK) replacing the role creation with your own role.

[timotk]

@otaviomacedo Thanks for your comment. Why would it not make sense to add the IRole to addEventNotification? From my limited understanding it seems rather reasonable.

By custom resource, do you mean using the following code, but in my own Stack? https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts#L27, where you would set your own role at https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts#L61 ?

E.g:

constructor(scope: Construct, id: string) {
    super(scope, id);

    this.role = // use my existing role here.

[bmkennedy-hcg]

I am also dealing with this issue. I don't have rights to create a user role so any attempt to run CDK calling .addEventNotification() fails. Interestingly, I am able to manually create the event notification in the console., so that must do the operation without creating a new role. It's not clear to me why there is a difference in behavior.

[britzp]

I am also having this issue. I don't have a workaround. I tried to make an Aspect to replace all IRole objects, but aspects apparently run after everything is linked.

[otaviomacedo]

Why would it not make sense to add the IRole to addEventNotification? From my limited understanding it seems rather reasonable.

@timotk addEventNotification provides a clean abstraction: type, target and filters. The role of the Lambda function that triggers the notification is an implementation detail, that we don't want to leak.

By custom resource, do you mean using the following code, but in my own Stack? https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts#L27, where you would set your own role at https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts#L61 ?

Yes, exactly.

[peterwoodworth]

Closing because this seems wrapped up. Ping me if you have any other questions

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.