aws-eks: aws-auth creation failure takes 1 hour

[taku-hatano]

Describe the bug

In creation cluster stack, aws-auth creation step was failed and it took 1 hour for fail parent stack.
Error message is below,

CloudFormation did not receive a response from your Custom Resource. Please check your logs for requestId [ca31f6eb-af1b-412e-8a06-f312c8affcc7]. If you are using the Python cfn-response module, you may need to update your Lambda function code so that CloudFormation can attach the updated version.

(Parent stack fails after 1 hour regardless of whether Lambda processing fails or succeeds)

Expected Behavior

If aws-auth creation fail/success, the parent Stack will also fail/success immediately.

Current Behavior

If aws-auth creation fail/success, the parent Stack fail after 1 hour.

Reproduction Steps

deploy by this code.

		const vpc = Vpc.fromLookup(this, "vpc", {
			vpcId: "your-vpc-id",
		});

		const eksRole = new Role(this, "eksRole", {
			assumedBy: new ServicePrincipal("eks.amazonaws.com"),
			managedPolicies: [
				ManagedPolicy.fromAwsManagedPolicyName("AmazonEKSClusterPolicy"),
				ManagedPolicy.fromAwsManagedPolicyName("AmazonEKSServicePolicy"),
			],
		});

		const clusterAdmin = new Role(this, "clusterAdmin", {
			assumedBy: new AccountRootPrincipal(),
		});

		const cluster = new Cluster(this, "cluster", {
			defaultCapacity: 0,
			vpc,
			role: eksRole,
			mastersRole: clusterAdmin,
			clusterName: "sample-eks-cluster",
			vpcSubnets: [
				{
					subnetType: SubnetType.PUBLIC,
				},
				{
					subnetType: SubnetType.PRIVATE_WITH_EGRESS,
				},
			],
		});

		const awsAuth = new AwsAuth(this, "awsAuth", {
			cluster,
		});
		awsAuth.addMastersRole(
			Role.fromRoleArn(this, "clusterAdminAtAwsAuth", clusterAdmin.roleArn),
			clusterAdmin.roleName,
		);

Possible Solution

I read deployed Lambda handler code, but I cannot find cfn response.
ref. here

Where is cfn response for Python custom resource handlers?

Additional Information/Context

No response

CDK CLI Version

2.137.0 (build bb90b4c)

Framework Version

No response

Node.js Version

v20.14.0

OS

AmazonLinux 2023.3.20240312

Language

TypeScript

Language Version

5.4.3

Other information

No response

[pahud]

Can you try remove this and create a new VPC and see if the issue still exists?

const vpc = Vpc.fromLookup(this, "vpc", {
			vpcId: "your-vpc-id",
		});

And

awsAuth.addMastersRole(
			Role.fromRoleArn(this, "clusterAdminAtAwsAuth", clusterAdmin.roleArn),
			clusterAdmin.roleName,
		);

This should not be required as when you specifiy

mastersRole: clusterAdmin,

The clusterAdmin should already be added with addMastersRole

aws-cdk/packages/aws-cdk-lib/aws-eks/lib/cluster.ts

Lines 1681 to 1685 in a46bbc3

	if (props.mastersRole) {
	const mastersRole = props.mastersRole;
	// map the IAM role to the `system:masters` group.
	this.awsAuth.addMastersRole(mastersRole);

[taku-hatano]

Can you try remove this and create a new VPC and see if the issue still exists?

I try it and process is complete successfully!
If I find out why the first code fails, I'll comment.

Thank you for your help.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.