aws-cdk-lib/aws-ec2: provisioning a VPC results in CREATE_FAILED for VpcRestrictDefaultSGCustomResourceProviderHandler

[Emilcrafter]

Describe the bug

When trying to provision a VPC, the stack fails to build. The error seems to be related to a Lambda function that is generated in the VPC creation

Expected Behavior

Getting the VPC added to my AWS account

Current Behavior

The stack fails to build. Here is the content of my terminal:

➜ vpc-issue git:(master) ✗ cdk deploy

✨ Synthesis time: 1.92s

current credentials could not be used to assume 'arn:aws:iam::302131982939:role/cdk-hnb659fds-deploy-role-302131982939-eu-north-1', but are for the right account. Proceeding anyway.
VpcIssueStack: start: Building d02b1747e71306e484fcbccfca49e4ab2ad70f1fc60cf29af912ea5a7b82e3e8:current_account-current_region
VpcIssueStack: success: Built d02b1747e71306e484fcbccfca49e4ab2ad70f1fc60cf29af912ea5a7b82e3e8:current_account-current_region
VpcIssueStack: start: Publishing d02b1747e71306e484fcbccfca49e4ab2ad70f1fc60cf29af912ea5a7b82e3e8:current_account-current_region
current credentials could not be used to assume 'arn:aws:iam::302131982939:role/cdk-hnb659fds-file-publishing-role-302131982939-eu-north-1', but are for the right account. Proceeding anyway.
VpcIssueStack: success: Published d02b1747e71306e484fcbccfca49e4ab2ad70f1fc60cf29af912ea5a7b82e3e8:current_account-current_region
current credentials could not be used to assume 'arn:aws:iam::302131982939:role/cdk-hnb659fds-lookup-role-302131982939-eu-north-1', but are for the right account. Proceeding anyway.
(To get rid of this warning, please upgrade to bootstrap version >= 8)
current credentials could not be used to assume 'arn:aws:iam::302131982939:role/cdk-hnb659fds-deploy-role-302131982939-eu-north-1', but are for the right account. Proceeding anyway.
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬─────────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────────────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼─────────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │
├───┼─────────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:security-group/${Vpc8378 │ Allow │ ec2:AuthorizeSecurityGroupEgress │ AWS:${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ │
│ │ EB38.DefaultSecurityGroup} │ │ ec2:AuthorizeSecurityGroupIngress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupEgress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupIngress │ │ │
└───┴─────────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────────────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ {"Fn::Sub":"arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"} │
└───┴────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See #1299)

Do you wish to deploy these changes (y/n)? y
VpcIssueStack: deploying... [1/1]
VpcIssueStack: creating CloudFormation changeset...
10:03:24 AM | CREATE_FAILED | AWS::Lambda::Function | CustomVpcRestrictD...derHandlerDC833E5E
Resource handler returned message: "Uploaded file must be a non-empty zip (Service: Lambda, Status Code: 400, Request ID: 8ce024f7-a7a9-4fc4-af1b-b0318c60ba8a)" (RequestToken: d5de3c48-449c-89c4-fcd6-21410780417f, HandlerErrorCode: InvalidRequest)

❌ VpcIssueStack failed: Error: The stack named VpcIssueStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "Uploaded file must be a non-empty zip (Service: Lambda, Status Code: 400, Request ID: 8ce024f7-a7a9-4fc4-af1b-b0318c60ba8a)" (RequestToken: d5de3c48-449c-89c4-fcd6-21410780417f, HandlerErrorCode: InvalidRequest)
at FullCloudFormationDeployment.monitorDeployment (/home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:397:10236)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (/home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:400:149977)
at async /home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:400:135508

❌ Deployment failed: Error: The stack named VpcIssueStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "Uploaded file must be a non-empty zip (Service: Lambda, Status Code: 400, Request ID: 8ce024f7-a7a9-4fc4-af1b-b0318c60ba8a)" (RequestToken: d5de3c48-449c-89c4-fcd6-21410780417f, HandlerErrorCode: InvalidRequest)
at FullCloudFormationDeployment.monitorDeployment (/home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:397:10236)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (/home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:400:149977)
at async /home/emil/.nvm/versions/node/v18.14.2/lib/node_modules/aws-cdk/lib/index.js:400:135508

The stack named VpcIssueStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "Uploaded file must be a non-empty zip (Service: Lambda, Status Code: 400, Request ID: 8ce024f7-a7a9-4fc4-af1b-b0318c60ba8a)" (RequestToken: d5de3c48-449c-89c4-fcd6-21410780417f, HandlerErrorCode: InvalidRequest)

Reproduction Steps

This is my entire stack file:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
// import * as sqs from 'aws-cdk-lib/aws-sqs';

export class VpcIssueStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {});
  }
}

Possible Solution

Maybe it does upload an empty zip. Better check that out

Additional Information/Context

No response

CDK CLI Version

2.82.0 (build 3a8648a)

Framework Version

2.82.0

Node.js Version

Tested on v18.16.0 and v18.14.2

OS

Windows 11 + WSL2 Ubuntu 22.04, also tested in dev container running the public.ecr.aws/lambda/nodejs:18 image (Amazon Linux)

Language

Typescript

Language Version

"typescript": "~5.0.4"

Other information

No response

[pahud]

Unfortunately I can't reproduce this in my account but I noticed you got this error message:

current credentials could not be used to assume 'arn:aws:iam::302131982939:role/cdk-hnb659fds-deploy-role-302131982939-eu-north-1', but are for the right account. Proceeding anyway.

CDK essentially uses this assumed role to deploy but looks like your current credentials just could not assume to that role. Maybe you will need to cdk bootstrap again to fix this error message. In general cases, the deploying role should allow the account principal to assume for deployment.

Check this doc for more details.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.