custom_resources: AwsCustomResource deployment fails with "Uploaded file must be a non-empty zip" error

[jscott-resilient]

Describe the bug

My project is currently on version 2.165.0 and upgrading to anything higher (I've tried 2.166.0) causes the following error to occur:

cf/Custom::CrossRegionStringParameterReaderCustomResourceProvider/Handler (CustomCrossRegionStringParameterReaderCustomResourceProviderHandler65B5F33A) Resource handler returned message: "Uploaded file must be a non-empty zip (Service: Lambda, Status Code: 400, Request ID: 7a077b2b-1336-4280-b3c1-198d2fbc08c2) (SDK Attempt Count: 1)

The construct code is as follows:

import * as cdk from 'aws-cdk-lib';

import { Construct } from 'constructs';

interface CrossRegionParameterReaderProps {
  region: string;
  parameterName: string;
  resource: string;
}

export class CrossRegionParameterReader extends cdk.custom_resources.AwsCustomResource {
  constructor(scope: Construct, name: string, props: CrossRegionParameterReaderProps) {
    const { parameterName, region, resource } = props;

    const ssmAwsSdkCall: cdk.custom_resources.AwsSdkCall = {
      service: 'SSM',
      action: 'getParameter',
      parameters: {
        Name: parameterName
      },
      region,
      physicalResourceId: { id: Date.now().toString() } // Update physical id to always fetch the latest version
    };

    super(scope, name, {
      onUpdate: ssmAwsSdkCall,
      policy: {
        statements: [
          new cdk.aws_iam.PolicyStatement({
            resources: [resource],
            actions: ['ssm:GetParameter'],
            effect: cdk.aws_iam.Effect.ALLOW
          })
        ]
      }
    });
  }

  public getParameterValue(): string {
    return this.getResponseField('Parameter.Value').toString();
  }
}

Thanks for looking into this! If you need anymore information please let me know!

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.165

Expected Behavior

The zipped lambda code within the cdk bootstrap s3 bucket is formatted correctly to allow deployment

Current Behavior

The zipped lambda code is defined within the bootstrap s3 bucket but causes the "Uploaded file must be a non-empty zip", it is a non empty zip file so the issue causing this error is unknown

Reproduction Steps

Upgrading aws-cdk-lib version higher than 2.165

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.1010.0 (build 6b421db)

Framework Version

No response

Node.js Version

v20.13.1

OS

macOS Sequoia Version 15.4

Language

TypeScript

Language Version

Typescript (5.8.3)

Other information

No response

[ykethan]

Hey @jscott-resilient, thank you for reaching out. On diving into the issue and working on reproducing the issue using the code provided, here's what i have tried

Reproductions steps:

1. installed: "aws-cdk-lib": "2.165.0" and defined the stack as follows

import * as cdk from "aws-cdk-lib";
import "source-map-support/register";
import { CrossRegionParameterReader } from "../lib/custom-empty-zip";

const app = new cdk.App();

// Create a stack to contain our resources
const stack = new cdk.Stack(app, "MyReproStack", {
  crossRegionReferences: true,
  env: {
    region: "us-east-1",
  },
});

// Create the CrossRegionParameterReader within the stack
new CrossRegionParameterReader(stack, "parameterreader", {
  region: "us-west-1",
  parameterName: "/my-app/staging/test",
  resource: "arn:aws:ssm:us-west-1:<account-id>:parameter/my-app/staging/test",
});

import * as cdk from "aws-cdk-lib";

import { Construct } from "constructs";

interface CrossRegionParameterReaderProps {
  region: string;
  parameterName: string;
  resource: string;
}

export class CrossRegionParameterReader extends cdk.custom_resources
  .AwsCustomResource {
  constructor(
    scope: Construct,
    name: string,
    props: CrossRegionParameterReaderProps
  ) {
    const { parameterName, region, resource } = props;

    const ssmAwsSdkCall: cdk.custom_resources.AwsSdkCall = {
      service: "SSM",
      action: "getParameter",
      parameters: {
        Name: parameterName,
      },
      region,
      physicalResourceId: { id: Date.now().toString() }, // Update physical id to always fetch the latest version
    };

    super(scope, name, {
      onUpdate: ssmAwsSdkCall,
      policy: {
        statements: [
          new cdk.aws_iam.PolicyStatement({
            resources: [resource],
            actions: ["ssm:GetParameter"],
            effect: cdk.aws_iam.Effect.ALLOW,
          }),
        ],
      },
    });
  }

  public getParameterValue(): string {
    return this.getResponseField("Parameter.Value").toString();
  }
}

2. cdk deploy
3. Then, updated the package.json to "aws-cdk-lib": "2.166.0",
4. cdk deploy but did not observe an error
5. made some change such as physicalResourceId and tried deploying. Additionally, changed the resource name to re-deploy the resource. But did not observe a Uploaded file must be a non-empty zip error.

Could let us know if the reproduction steps used does align with your project setup and the steps used?
Do provide us any additional information that could help us reproduce the issue?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.