(cloudfront, lambda): cyclic dependency for Lambda@Edge when using role

When using the CloudFront EdgeFunction with a role specified by the developer, a cyclic dependency error occurs.

Reproduction Steps

import * as cloudfront from "@aws-cdk/aws-cloudfront";
import * as origins from "@aws-cdk/aws-cloudfront-origins";
import * as lambda from "@aws-cdk/aws-lambda";
import * as core from "@aws-cdk/core";
import * as iam from "@aws-cdk/aws-iam";

import { Stack, StackProps } from "@_org_/lib-infra-common";

export class EdgeLambdaStack extends Stack {
  constructor(scope: core.Construct, customProps: StackProps, stackProps: core.StackProps = {}) {
    super(scope, customProps, stackProps);

    const edgeLambdaRole = new iam.Role(this, "LambdaRole", {
      roleName: core.PhysicalName.GENERATE_IF_NEEDED,
      assumedBy: new iam.CompositePrincipal(
        new iam.ServicePrincipal("lambda.amazonaws.com"),
        new iam.ServicePrincipal("edgelambda.amazonaws.com"),
      ),
       // ...any sort of managed policy (not needed to reproduce)
    });

    const myFunc1 = new cloudfront.experimental.EdgeFunction(this, "MyFunction1", {
      runtime: lambda.Runtime.NODEJS_10_X,
      handler: "index.handler",
      code: lambda.Code.fromInline("return"),
      role: edgeLambdaRole,
    });

    new cloudfront.Distribution(this, "myDist", {
      defaultBehavior: {
        origin: new origins.HttpOrigin("www.example.com"),
        edgeLambdas: [
          {
            functionVersion: myFunc1.currentVersion,
            eventType: cloudfront.LambdaEdgeEventType.VIEWER_REQUEST,
          },
        ],
      },
    });
  }
}

What did you expect to happen?

A Lambda function would be created in the us-east-1 region, and the role would be created in IAM globally.

What actually happened?

Error: 'Dev-Marketing-EdgeLambdaStack' depends on 'edge-lambda-stack-c8c09337b87f7807acc2002239aca2181ae1916d18' (dependency added using stack.addDependency()). Adding this dependency ("edge-lambda-stack-c8c09337b87f7807acc2002239aca2181ae1916d18/MyFunction1/Resource" depends on "Dev-Marketing-EdgeLambdaStack/LambdaRole/Resource") would create a cyclic reference.
    at Stack._addAssemblyDependency (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/stack.ts:724:13)
    at Object.addDependency (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/deps.ts:52:20)
    at CfnFunction.addDependsOn (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/cfn-resource.ts:245:5)
    at Object.prepareApp (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/private/prepare-app.ts:26:16)
    at Object.synthesize (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/private/synthesis.ts:24:3)
    at App.synth (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/stage.ts:188:23)
    at process.<anonymous> (/Users/arjunnaha/Developer/_org_/web-marketing/node_modules/@aws-cdk/core/lib/app.ts:123:45)
    at Object.onceWrapper (node:events:483:26)
    at process.emit (node:events:376:20)
    at process.EventEmitter.emit (node:domain:470:12)

Environment

• CDK CLI Version: 1.90.1 (build 0aee440)
• Framework Version: 1.90.1
• Node.js Version: v15.5.0
• OS: macOS Big Sur 11.2.1
• Language (Version): TypeScript (4.1.3)

---

This is 🐛 Bug Report

[njlynch]

@asnaseer-resilient -

I thought my code is written such that the edge lambda function is indeed creating the role role: new cdkIam.Role(this, ‘LambdaAtEdgeRole’, { roleName: CDK_UTILS.resourceName(‘cf-lae-role’), assumedBy: new cdkIam.CompositePrincipal(new cdkIam.ServicePrincipal(‘lambda.amazonaws.com’), new cdkIam.ServicePrincipal(‘edgelambda.amazonaws.com’)) }),

No, in the above example, you are still creating the role explicitly and passing it to the Function. For the function to create the role, you need to leave the role parameter as undefined; then once the Function has been created, use lambdaAtEdgeFunction.role to access the role and modify the permissions as required.

[njlynch]

I think this is likely a permanent work-around, until someone more clever than me comes around with a solution. 😃

Detecting that the Role passed in might cause a circular dependency, then creating a third stack, then re-parenting the role into a new stack, is not something I would expect (nor really want) the construct to do. I can imagine all sorts of unintended consequences with that approach.

I’m going to close this, but feel free to comment (and @ me) if you have any follow-ups.