fix(provisioning): enrich Events Connection/ApiDestination Arn so ApiDestination deploys - #922
Merged
Conversation
…Destination deploys AWS::Events::Connection is CC-API-provisioned with primaryIdentifier=Name, so its cdkd physicalId is the connection name, not the ARN. Its readOnly Arn attribute was not enriched, so an AWS::Events::ApiDestination whose ConnectionArn is Fn::GetAtt(Connection, 'Arn') (the canonical CDK shape) received the bare name and the ApiDestination CREATE failed CC model validation (#/ConnectionArn: failed validation constraint for keyword [pattern]) — the whole webhook pattern was undeployable. Add enrichResourceAttributes cases for AWS::Events::Connection (Arn/SecretArn via DescribeConnection; ArnForPolicy derived by stripping the ARN's unique suffix) and AWS::Events::ApiDestination (Arn via DescribeApiDestination; ArnForPolicy derived likewise), best-effort. Same enrichment-gap bug class as #844/#864/#865/#866. - 5 new unit tests in cloud-control-provider.test.ts - new real-AWS eventbridge-api-destination integ fixture (Connection + ApiDestination + Rule target; asserts resolved ConnectionArn + target Arn are real ARNs, deploy/destroy clean) - regenerated enrichment-coverage (both types join enrichedWithoutCachedSchema, the pure-CC pattern) + integ/scenario-coverage matrices - changelog entry Found by /hunt-bugs.
…tion enrichment Address pr-test-reviewer nit on #922: pin the partial-overlay path where CC already returned SecretArn but not Arn — the outer guard still fires and the per-field !enriched[x] guards fill Arn/ArnForPolicy while keeping the CC-returned SecretArn. Update changelog test count 5 -> 6.
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 21, 2026
## [0.230.3](v0.230.2...v0.230.3) (2026-06-21) ### Bug Fixes * **provisioning:** enrich Events Connection/ApiDestination Arn so ApiDestination deploys ([#922](#922)) ([f49a154](f49a154))
|
🎉 This PR is included in version 0.230.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Found via
/hunt-bugs. A standardevents.Connection+events.ApiDestinationpair (the daily webhook pattern) was undeployable — the ApiDestination CREATE failed withModel validation failed (#/ConnectionArn: failed validation constraint for keyword [pattern]).AWS::Events::Connectionis Cloud-Control-provisioned (no SDK provider) and itsprimaryIdentifierisName, so cdkd's physicalId for a Connection is the connection name, not the ARN. Its readOnlyArnattribute was not populated byenrichResourceAttributes, so anAWS::Events::ApiDestinationwhoseConnectionArnisFn::GetAtt(Connection, 'Arn')(the canonical CDK shape) received the bare name and AWS rejected the invalid ConnectionArn. The full connection ARN carries a random unique suffix (.../connection/<name>/<uuid>), so it cannot be string-constructed from account + region + name. Same systemic enrichment-gap bug class as #844 / #864 / #865 / #866.Fix
src/provisioning/cloud-control-provider.ts: add twoenrichResourceAttributescases (mirroring the existing Kinesis / Lambda::Url / RDS branches, best-effort try/catch):AWS::Events::Connection—Arn+SecretArnviaDescribeConnection;ArnForPolicyderived from the full ARN by stripping the trailing/<uuid>segment (the SDK does not return it).AWS::Events::ApiDestination—ArnviaDescribeApiDestination;ArnForPolicyderived likewise.A failed Describe leaves the CC attribute shape unchanged and never fails the deploy.
Both types are pure-CC (no SDK provider, no cached CFn schema fixture — per the established pattern that keeps
tests/fixtures/cfn-schemas/1:1 with registered SDK providers, enforced by theno stale fixture files for unregistered typestest). They joindocs/_generated/enrichment-coverage.json'senrichedWithoutCachedSchemalist alongside the other enriched pure-CC types (ElastiCache::ReplicationGroup / Redshift::Cluster / OpenSearchService::Domain).Test plan
cloud-control-provider.test.ts: Connection Arn/SecretArn/ArnForPolicy overlay + theDescribeConnection({Name: physicalId})command shape (the load-bearing check for the bug class); already-present-attrs short-circuit (no call, no overwrite); per-field-independence partial overlay (CC returned SecretArn but not Arn); best-effort failure; ApiDestination Arn/ArnForPolicy overlay + command shape; ApiDestination best-effort failure.eventbridge-api-destinationinteg fixture: deploys Connection + ApiDestination + a Rule whose target is the ApiDestination, asserts the resolvedConnectionArnAND the Rule's target Arn reaching AWS are real ARNs (not bare names), then destroys clean.ConnectionArnresolved toarn:aws:events:...:connection/<name>/<uuid>); destroy clean, 0 orphans.enrichment-coverage+integ-coverage+scenario-coveragematrices regenerated.Notes for review
cloud-control-provider.tsis not undersrc/provisioning/providers/**nor anyinteg-broad/integ-localscope, so those integ gates do not apply; the destroy path was nonetheless exercised cleanly by the new integ.