Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

(aws-wafv2): Received the CREATE_FAILED message, but resource was created.

See original GitHub issue

It says that webacl could not be created due to lack of permission, but it is created in the console. And if I check in cloudformation, none of them made webacl.

Deleting the stack does not delete the webacl, I have to delete it directly from the console to clear it. image

Reproduction Steps


export class CdkTestStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new waf.CfnWebACL(this, "kkkkkkkkkkkhy", {
      defaultAction: {
        block: {}
        cloudWatchMetricsEnabled: false,
        sampledRequestsEnabled: false,
        metricName: "123khymetricName"


What did you expect to happen?

Since I received the message CREATE_FAILED No resource has been created.

What actually happened?

I was able to see CREATE_FAILED because I didn’t have wafv2:getWebACL permission, but the resource was actually created.


  • CDK CLI Version : 1.75.0
  • Framework Version: 1.75.0 (build 7708242)
  • Node.js Version: v10.15.3
  • OS : macOS 10.14.6
  • Language (Version): TypeScript (3.8.3)


  1. I only have CloudformationFullAccessPolicy and wafv2:CreateWebACL.
  2. With the above two rights, the CDK says that it is not authorized as follows.
User: arn:aws:iam::871697823052:user/khy is not authorized to perform: wafv2:GetWebACL on r
esource: arn:aws:wafv2:ap-northeast-2:871697823052:regional/webacl/kkkkkkkkkkkhy-gXkvdU7RGK
  1. If I create it myself in the console with above two policy, the webACL is created without any errors.

This is 🐛 Bug Report

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:5 (3 by maintainers)

github_iconTop GitHub Comments

shivlakscommented, Nov 27, 2020

@HoYoung1 thanks so much for the great detail on the reproduction steps! it does indeed seem like an odd experience that when creation fails that the resource would still be created. I will pass this feedback along to the wafv2 team so we can better understand whether that’s a bug that they can fix.

since this isn’t quite a CDK bug, i’m going to drop the bug label and mark this as guidance. I’ll update this issue once I hear back from the team!

thanks a bunch!!

github-actions[bot]commented, Jun 25, 2021


Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.

Read more comments on GitHub >

github_iconTop Results From Across the Web

CreateWebACL - AWS WAFV2
Creates a WebACL per the specifications provided. A web ACL defines a collection of rules to use to inspect and control web requests....
Read more >
Troubleshoot WAFInvalidParameterException error in AWS WAF
A parameter name or value specified isn't valid. The ARN referenced in the request is from a resource that can't be associated to...
Read more >
Resolve limit exceeded error when adding rules in AWS WAF
The capacity of the rule group can't be changed after it's created. You must create a new rule group, and then add it...
Read more >
UpdateWebACL - AWS WAFV2
If a change has been made, the update fails with a WAFOptimisticLockException . If this happens, perform another get , and use the...
Read more >
AssociateWebACL - AWS WAFV2
Associates a web ACL with a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB), ......
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found