(aws-backup): (BackupVault.fromBackupVaultArn fails to parse backup vault ARN)

[eriklztiqqe]

Describe the bug

If you try to include a reference to an already defined backup vault through its ARN, and then use the vault in a backup plan rule, you get an error when you try to deploy the stack which uses it.

Error: Failed to create ChangeSet cdk-deploy-change-set on datalake-redshift: FAILED, Template error: Fn::Select cannot select nonexistent value at index 1

Expected Behavior

No error, referencing the backup vault construct in a backup plan should work.

Current Behavior

A stack trace when the change set is about to be created, which includes the error:

Error: Failed to create ChangeSet cdk-deploy-change-set on datalake-redshift: FAILED, Template error: Fn::Select cannot select nonexistent value at index 1

Reproduction Steps

const vault = BackupVault.fromBackupVaultArn('arn:aws:backup:eu-north-1:123456789012:backup-vault:blablabla')
const plan = new backupPlan(scope, 'plan', { backupVault: vault });

Workaround currently is to change the ARN to use a slash between "backup-vault" and the backup vault name, before calling fromBackupVaultArn().

Possible Solution

Change fromBackupVaultArn to use ArnFormat.COLON_RESOURCE_NAME instead of ArnFormat.SLASH_RESOURCE_NAME.

Additional Information/Context

Looking at the generated CloudFormation where it is used, one can see the following below. The problem here is that "Fn::Select" uses index 1, after splitting by "/". However, there is no "/" separator in a backup vault ARN, only ":". So the index does not work.

"BackupPlanRule": [
      {
       "EnableContinuousBackup": true,
       "Lifecycle": {
        "DeleteAfterDays": 7
       },
       "RuleName": "datalake_backup_plan-PITR-rule",
       "TargetBackupVault": {
        "Fn::Select": [
         1,
         {
          "Fn::Split": [
           "/",
           {
            "Fn::Select": [
             5,
             {
              "Fn::Split": [
               ":",
               {
                "Ref": "backupvaultarnparamParameter"
               }
              ]
             }
            ]
           }
          ]
         }
        ]

This is verified by looking at the code for the BackupVault in aws-backup module (below from release 2.76.0), where fromBackupVaultArn() uses ArnFormat.SLASH_RESOURCE_NAME instead of ArnFormat.COLON_RESOURCE_NAME.

/**
 * A backup vault
 */
export class BackupVault extends BackupVaultBase {
  /**
   * Import an existing backup vault by name
   */
  public static fromBackupVaultName(scope: Construct, id: string, backupVaultName: string): IBackupVault {
    const backupVaultArn = Stack.of(scope).formatArn({
      service: 'backup',
      resource: 'backup-vault',
      resourceName: backupVaultName,
      arnFormat: ArnFormat.COLON_RESOURCE_NAME,
    });

    return BackupVault.fromBackupVaultArn(scope, id, backupVaultArn);
  }

  /**
   * Import an existing backup vault by arn
   */
  public static fromBackupVaultArn(scope: Construct, id: string, backupVaultArn: string): IBackupVault {
    const parsedArn = Stack.of(scope).splitArn(backupVaultArn, ArnFormat.SLASH_RESOURCE_NAME);

CDK CLI Version

2.76.0

Framework Version

No response

Node.js Version

16

OS

macOS

Language

Python

Language Version

3.8

Other information

No response

[pahud]

Thank you for your detailed insight. I can confirm the ArnFormat is inconsistent.

aws-cdk/packages/aws-cdk-lib/aws-backup/lib/vault.ts

Lines 227 to 246 in cefbb33

	export class BackupVault extends BackupVaultBase {
	/**
	* Import an existing backup vault by name
	*/
	public static fromBackupVaultName(scope: Construct, id: string, backupVaultName: string): IBackupVault {
	const backupVaultArn = Stack.of(scope).formatArn({
	service: 'backup',
	resource: 'backup-vault',
	resourceName: backupVaultName,
	arnFormat: ArnFormat.COLON_RESOURCE_NAME,
	});
	return BackupVault.fromBackupVaultArn(scope, id, backupVaultArn);
	}
	/**
	* Import an existing backup vault by arn
	*/
	public static fromBackupVaultArn(scope: Construct, id: string, backupVaultArn: string): IBackupVault {
	const parsedArn = Stack.of(scope).splitArn(backupVaultArn, ArnFormat.SLASH_RESOURCE_NAME);

Making this a p2 bug. Any PRs are welcome and appreciated!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.