Panic when trying to update AWS wafv2 WebAcl #2815
Comments
DanielSchiavini
added
kind/bug
|
OK I have now managed to apply the update after running |
|
@DanielSchiavini Do you know which attributes were changed in AWS? Or any other concrete steps that I could you to reproduce the issue locally? |
mikhailshilkov
added
awaiting-feedback
|
@mikhailshilkov the following rule had been added to AWS and then "backported" to pulumi: |
mikhailshilkov
added
impact/panic
|
@DanielSchiavini Thank you! One more question - which |
|
These are my dependencies |
|
A few questions:
|
"node_modules/@pulumi/aws": {
"version": "6.0.4",
"resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-6.0.4.tgz",
"integrity": "sha512-g8t+LuKwEEGX7bKUcYpB8gr1xtrJm3PAt26Js5QztSWDiujy9ehmk4CeEgKLfMR9EGmav6jFSSvwX5IQXSPgog==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/pulumi": "^3.0.0",
"builtin-modules": "3.0.0",
"mime": "^2.0.0",
"read-package-tree": "^5.2.1",
"resolve": "^1.7.1"
}
},
"node_modules/@pulumi/awsx": {
"version": "1.0.5",
"resolved": "https://registry.npmjs.org/@pulumi/awsx/-/awsx-1.0.5.tgz",
"integrity": "sha512-iGkDzPalPhzRlfqCaWgwJkaA8EfgPwzWkcqdg0TgcnUefNwKGEXfEelORxMXKxZe5M0VV3U3ljrEq6P0SLCtWg==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/aws": "^5.35.0",
"@pulumi/docker": "^3.6.1",
"@pulumi/pulumi": "^3.0.0",
"@types/aws-lambda": "^8.10.23",
"mime": "^2.0.0"
}
},
"node_modules/@pulumi/awsx/node_modules/@pulumi/aws": {
"version": "5.42.0",
"resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-5.42.0.tgz",
"integrity": "sha512-1h7Q5DjwoWVGxhBMcNragx/Q1US1KT7g29Tk3RghTg/9N7rGUbzTQKEXSrGgRSjGA/aKTbU+gt5A9ZmhONLiLg==",
"hasInstallScript": true,
"dependencies": {
"@pulumi/pulumi": "^3.0.0",
"aws-sdk": "^2.0.0",
"builtin-modules": "3.0.0",
"mime": "^2.0.0",
"read-package-tree": "^5.2.1",
"resolve": "^1.7.1"
}
}, |
|
Unfortunately I cannot reproduce this. Judging by the stack trace it is a panic in the tags interceptor due to an unexpected nil in GetRawPlan: I'm not sure how refresh fixed this, because it seems it should be happening during planning an Update before hitting up the cloud. I've tried running a few variations of the program through an Update on the listed versions, no repro. We did historically have issues with panics in GetRawPlan, fixed since v3.45.0 of the terraform bridge framework used in this provider but it seems the stack trace is referencing a newer v3.58.0 version. new wafv2.WebAcl('firewall', {
name: 'firewall',
description: 'Blocks IPs if they do too many requests per minute.',
defaultAction: { allow: {} },
rules: [
{
name: "rate-limit",
priority: 0,
rateBasedStatement: {
limit: 2000,
aggregateKeyType: "IP"
}
},
action: {
block: {
customResponse: {
responseCode: 429,
//customResponseBodyKey: "rate-limit-response"
}
}
},
visibilityConfig: {
sampledRequestsEnabled: true,
cloudwatchMetricsEnabled: true,
metricName: "rate-limit"
}
},
{
name: "account-creation-rate-limit",
priority: 1,
statement: {
rateBasedStatement: {
limit: 200,
aggregateKeyType: "IP",
scopeDownStatement: {
andStatement: {
statements: [
{
byteMatchStatement: {
searchString: "/api/v1/account",
fieldToMatch: { uriPath: {} },
textTransformations: [
{
priority: 0,
type: "NONE"
}
],
positionalConstraint: "CONTAINS"
}
},
{
notStatement: {
statements: [{
byteMatchStatement: {
searchString: "GET",
fieldToMatch: {
method: {}
},
textTransformations: [
{
priority: 0,
type: "NONE"
}
],
positionalConstraint: "EXACTLY"
}
}]
}
}
]
}
}
}
},
action: {
block: {
customResponse: {
responseCode: 429,
//customResponseBodyKey: "rate-limit-response"
}
}
},
visibilityConfig: {
sampledRequestsEnabled: true,
cloudwatchMetricsEnabled: true,
metricName: "account-creation-rate-limit"
}
}
],
visibilityConfig: { sampledRequestsEnabled: true, cloudwatchMetricsEnabled: true, metricName: 'firewall' },
customResponseBodies: [{
key: `firewall-rate-limit-response`,
content: 'Too many requests, please try again later.',
contentType: 'TEXT_PLAIN',
}],
scope: 'REGIONAL',
}); |
|
I've tried harder here testing a few upgrade scenarios along these lines and tracing the place where this panic is received, but still wasn't able to reproduce. Verbose logs or a repro would be extremely valuable here. |
|
Sorry, I also cannot reproduce the issue anymore. Thanks for all your effort. |
mikhailshilkov
added
the
resolution/no-repro
|
Closing for now... please let us know if the issue still occurs. |
What happened?
When trying to apply updates, the following error is received:
Example
This is the code that raises the error:
Output of
pulumi aboutAdditional context
When downloading the JSON from the AWS console, the
andStatementseems to expect a singlestatement, but Pulumi requires a list ofstatementsContributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: