aws_apprunner: can't retrieve AutoScalingConfigurationArn attribute

[jaus14]

Describe the bug

Until now, I had been defining aws_apprunner’s AutoScalingConfiguration and using that definition during the creation of the App Runner service via CDK without any problems. However, starting today, I began encountering the following error and the deployment is now failing

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.1012.0

Expected Behavior

pass this code

Current Behavior

Error

Unable to retrieve AutoScalingConfigurationArn attribute for AWS::AppRunner::AutoScalingConfiguration, with error message Error occurred during operation 'Failed to list tags'.

Reproduction Steps

autoScalingConf definition

    const autoScalingConf = new aws_apprunner.CfnAutoScalingConfiguration(
      this,
      "AppRunnerAutoScalingConfiguration",
      {
        autoScalingConfigurationName: "apprunner-autoscaling",
        minSize: 1,
        maxSize: env.APP_RUNNER_MAX_SIZE,
      }
    )

use autoScalingConf to AppRunner definition

new aws_apprunner.CfnService(this, "AppRunnerService", {
    ...
    autoScalingConfigurationArn:
        autoScalingConf.attrAutoScalingConfigurationArn,
    ...
}

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.1012.0 (build e4c1f15)

Framework Version

No response

Node.js Version

v22.12.0

OS

macOS Sequoia

Language

TypeScript

Language Version

TypeScript (5.6.3)

Other information

No response

[pahud]

Hi @jaus14,

Thanks for reporting this issue regarding the failure to retrieve the AutoScalingConfigurationArn attribute for aws_apprunner.CfnAutoScalingConfiguration.

Summary:
You're encountering a CloudFormation deployment error (Unable to retrieve AutoScalingConfigurationArn attribute... Error occurred during operation 'Failed to list tags') when referencing autoScalingConf.attrAutoScalingConfigurationArn in your CfnService definition. This setup was previously working with CDK v2.1012.0, but now fails despite using the same version.

Analysis:
The error message "Failed to list tags" points towards an issue occurring during the CloudFormation deployment process when it tries to resolve the ARN attribute using Fn::GetAtt. This suggests the problem might lie outside the CDK L1 construct definition itself, potentially related to:

1. IAM Permissions: The role used for deployment might lack the necessary permissions (e.g., apprunner:ListTagsForResource) required by the App Runner service backend when creating or referencing the Auto Scaling Configuration.
2. AWS Backend Change: There might have been a recent subtle change in the AWS App Runner or CloudFormation service behavior related to how this attribute is resolved or how tags are handled for this resource type.

Troubleshooting Suggestions:

• Verify the IAM permissions associated with your CDK deployment role. Ensure it includes permissions for App Runner actions, specifically related to tagging if possible.
• Check the AWS Health Dashboard or App Runner release notes for any recent changes in your deployment region.
• As a diagnostic step, try adding an explicit dependency using service.addDependency(autoScalingConf) to see if it influences the timing, although the error nature makes this less likely to be the root cause.

1. Is this error message from Cloudformation during the deployment?
2. Could you please double-check the IAM permissions for the role CloudFormation uses during this deployment?
3. Are you able to provide a minimal full reproducible cdk app that we can simply copy and see if it reproduces in our account?

[fecmcd]

Hi,

Also facing the same issue.

CDK version 2.1012.0 (build e4c1f15)

I've confirmed the role used for deployment has full Admin permissions and also tried adding a dependency between the service and ASG.

The error is returned by CFN:

AppRunnerService - AWS::AppRunner::Service
CREATE_FAILED

Unable to retrieve AutoScalingConfigurationArn attribute for AWS::AppRunner::AutoScalingConfiguration, with error message Error occurred during operation 'Failed to list tags'.

---

It really seems to be caused by AppRunner service failing to resolve the AutoScalingConfiguration ARN using GetAtt. The workaround that I've tested is to create all resources first (except for the AppRunner service), then update the stack to include the AppRunner service, the autoScalingConfigurationArn needs to be hardcoded. (cannot use "autoScalingConfigurationArn: autoScalingConfig.attrAutoScalingConfigurationArn").

Following is a sample code to replicate the issue.

import * as cdk from 'aws-cdk-lib';
import * as apprunner from 'aws-cdk-lib/aws-apprunner';
import { Role, ServicePrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class MyAppRunnerProjectStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create an auto scaling configuration
    const autoScalingConfig = new apprunner.CfnAutoScalingConfiguration(this, 'AutoScalingConfig', {
      autoScalingConfigurationName: 'MyAutoScalingConfig',
      maxConcurrency: 100,
      maxSize: 5,
      minSize: 1,
      tags: [{
        key: 'Environment',
        value: 'Production'
      }]
    });

    // Create the instance role
    const instanceRole = new Role(this, 'AppRunnerInstanceRole', {
      assumedBy: new ServicePrincipal('tasks.apprunner.amazonaws.com'),
      roleName: 'AppRunnerInstanceRole'
    });

    // Add ECR access policy to instance role
    instanceRole.addToPolicy(new PolicyStatement({
      effect: Effect.ALLOW,
      actions: [
        'ecr:GetDownloadUrlForLayer',
        'ecr:BatchCheckLayerAvailability',
        'ecr:BatchGetImage',
        'ecr:DescribeImages',
        'ecr:GetAuthorizationToken'
      ],
      resources: ['*']
    }));

    // Create the App Runner service
    const appRunnerService = new apprunner.CfnService(this, 'AppRunnerService', {
      serviceName: 'my-apprunner-service',
      
      sourceConfiguration: {
        autoDeploymentsEnabled: false,
        imageRepository: {
          imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
          imageRepositoryType: 'ECR_PUBLIC',
        },
      },

      instanceConfiguration: {
        cpu: '1024',
        memory: '2048',
        instanceRoleArn: instanceRole.roleArn,
      },

      autoScalingConfigurationArn: autoScalingConfig.attrAutoScalingConfigurationArn,

      networkConfiguration: {
        egressConfiguration: {
          egressType: 'DEFAULT',
        },
      },
    });

    // Add dependency: Service depends on Auto Scaling Configuration
    appRunnerService.addDependency(autoScalingConfig);
  }
}

[pahud]

Thank you. This seems to be some underlying issue around CFN and doesn't seem to be a CDK bug.

We are reaching out internally with this tracking ID V1758965253.

[bcliffor]

Just +1'ing that I am also experiencing this issue and had to hardcode our autoScalingConfigurationArn to get things to work again. Looking forward to a fix.