aws-cdk-lib/aws-s3: How to add depend on between s3 bucket policy and event notification?

[zhaoyi0113]

Describe the feature

I am using CDK to deploy s3 bucket and also add an event notification on that bucket. The code I have is:

const bucket = new BaseS3Bucket(this, "bucket", {
      versioned: true,
      enforceSSL: true,
      bucketName: this.bucketName,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      accessControl: options.setAccessControl !== false ? s3.BucketAccessControl.PRIVATE : undefined,
      publicReadAccess: false,
      encryption: s3.BucketEncryption.KMS_MANAGED,
      serverAccessLogsBucket: logBucket,
      serverAccessLogsPrefix: 'deployment-logs',
      lifecycleRules: [
        {
          id: 'NonCurrentVersionRule',
          enabled: true,
          noncurrentVersionExpiration: cdk.Duration.days(BucketCdkStack.NON_CURRENT_VERSION_EXPIRATION_DAY),
        },
      ],
    });
    const topic = cdk.aws_sns.Topic.fromTopicArn(
      this,
      "topic",
      topicArn,
    );
bucket.policy?.node.addDependency(topic);
    bucket.addEventNotification(s3.EventType.OBJECT_REMOVED_DELETE, new cdk.aws_s3_notifications.SnsDestination(topic));

The problem I have is I got a deployment error: Resource handler returned message: "A conflicting conditional operation is currently in progress against this resource. Please try again.

It says there are multiple operations tried to deploy at the same time which conflict with each other. When examining the cloud trail, I found there are two events happened at the same time period, one is PutBucketPolicy, the other is PutBucketNotification.

How can I add depend_on between PutBucketPolicy and PutBucketNotification?

Use Case

Solve conflict error during deployment

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

"aws-cdk": "^2.80.0",

Environment details (OS name and version, etc.)

Mac 14

[indrora]

You have a circular dependency: By adding the notification to the bucket, you've created an intrinsic dependency of the bucket on the topic. By adding a dependency of the topic on the bucket, you have created an impossible to resolve dependency graph.

Create each construct separately and assign it. Tokens will be used in place and CloudFormation will be able to resolve it.

[peterwoodworth]

@indrora the topic is imported, which means there won't be a topic in the CloudFormation template to create a cyclic resource. This also isn't typically the error message you'd see when a circular dependency is created. Can you expand on your findings and provide an example of how to work around this?

[tim-finnigan]

Converting to a discussion since this involves a guidance question. Please let us know if you have any updates on your end as far as testing on more recent versions.