fix(s3): add bucket policy dependency to notification resource

[yerzhan7]

Issue

Closes #27600.
Closes #16811.

Reason for this change

PutBucketPolicy and PutBucketNotification API calls are happening at the same time and causing race condition because S3 does not allow parallel bucket edits.

Description of changes

Add dependency on bucket policy to custom resource so that PutBucketPolicy API call is always executed before PutBucketNotification.

Description of how you validated changes

I've reproduced the bug locally and this solution fixed it.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[GavinZZ]

I'd like to hear your thought on the dependency solution over the exponential backoff/retry solution. I worry that this fix doesn't fix all issues but only the race condition between adding bucket policy and put bucket notfications. If there's another race condition between two other bucket actions, then the transient issue still persists.

[yerzhan7]

If there's another race condition between two other bucket actions, then the transient issue still persists.

From my quick testing there are no race conditions with other S3 L1 constructs. (AWS::S3::AccessPoint, AWS::S3::StorageLens, AWS::S3::MultiRegionAccessPoint)

So, it looks like S3 has only 2 conflicting CFN bucket resources: AWS::S3::Bucket and AWS::S3::BucketPolicy. Resource Custom::S3BucketNotifications already depends on AWS::S3::Bucket. In this PR I am adding additional dependency on AWS::S3::BucketPolicy.

I'd like to hear your thought on the dependency solution over the exponential backoff/retry solution.

If we add retry logic for PutNotification API inside Custom Resource then CFN stack would still fail for AWS::S3::BucketPolicy resource because we cannot add exponential backoff to L1 bucket policy construct.

[GavinZZ]

LGTM, thanks for drafting the PR and answering my questions.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: fd372f4
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).