(aws_cdk.aws_lakeformation.CfnTagAssociation): failing to deploy: NotStabilized

[plazmakeks]

Describe the bug

I'm trying to assign a LF Tag to a database and a table in that database and keep on getting the error message

UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Resource of type 'AWS::LakeFormation::TagAssociation' with identifier 'ResourceModel(resource=Resource(catalog=null, database=DatabaseResource(catalogId=catalogId, name=database_name), table=TableResource(catalogId=catalogId, databaseName=database_name, name=table_name, tableWildcard=null), tableWithColumns=null), lFTags=[LFTagPair(catalogId=catalogId, tagKey=tagKey, tagValues=[tagValue])], resourceIdentifier=null, tagsIdentifier=null)' did not stabilize." (RequestToken: <token>, HandlerErrorCode: NotStabilized)

This is my code

aws_lakeformation.CfnTagAssociation(
            scope=self,
            id="associationId",
            lf_tags=[
                aws_lakeformation.CfnTagAssociation.LFTagPairProperty(
                    catalog_id=catalogId,
                    tag_key=tagKey,
                    tag_values=[tagValue],
                )
            ],
            resource=aws_lakeformation.CfnTagAssociation.ResourceProperty(
                database=aws_lakeformation.CfnTagAssociation.DatabaseResourceProperty(
                    catalog_id=catalogId,
                    name=database_name,
                ),
                table=aws_lakeformation.CfnTagAssociation.TableResourceProperty(
                    catalog_id=catalogId,
                    database_name=database_name,
                    name=table_name,
                ),
            ),
        )

and the corresponding stack trace

4:54:46 PM | CREATE_FAILED        | AWS::LakeFormation::TagAssociation | my_stack_id
Resource handler returned message: "Resource of type 'AWS::LakeFormation::TagAssociation' with identifier 'ResourceModel(resource=Resource(catalog=null, database=DatabaseResource(catalogId=catalogId, name=database_name), table=TableResource(catalogId=catalogId, databaseName=database_name, name=table_name, tableWildcard=null), tableWithColumns=null), lFTags=[LFTagPair(catalogId=catalogId, tag
Key=tagKey, tagValues=[tagValue])], resourceIdentifier=null, tagsIdentifier=null)' did not stabilize." (RequestToken: token, HandlerErrorCode: NotStabilized)


 ❌  MyStack (my_stack) failed: Error: The stack named my_stack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Resource of type 'AWS::LakeFormation::TagAssociation' with identifier 'ResourceModel(resource=Resource(catalog=null, database=DatabaseResource(catalogId=catalogId, name=database_name), table=TableResource(catalogId=catalogId, databaseName=database_name, name=table_name, tableWildcard=null), tableWithColumns=null), lFTags=[LFTagPair(catalogId=catalogId, tagKey=tagKey, tagValues=[tagValue])], resourceIdentifier=null, tagsIdentifier=null)' did not stabilize." (RequestToken: token, HandlerErrorCode: NotStabilized)
    at FullCloudFormationDeployment.monitorDeployment (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:412:10236)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:415:153172)
    at async /opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:415:136968

 ❌ Deployment failed: Error: The stack named my_stack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Resource of type 'AWS::LakeFormation::TagAssociation' with identifier 'ResourceModel(resource=Resource(catalog=null, database=DatabaseResource(catalogId=catalogId, name=database_name), table=TableResource(catalogId=catalogId, databaseName=database_name, name=table_name, tableWildcard=null), tableWithColumns=null), lFTags=[LFTagPair(catalogId=catalogId, tagKey=tagKey, tagValues=[tagValue])], resourceIdentifier=null, tagsIdentifier=null)' did not stabilize." (RequestToken: token, HandlerErrorCode: NotStabilized)
    at FullCloudFormationDeployment.monitorDeployment (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:412:10236)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:415:153172)
    at async /opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:415:136968

The stack named my_stack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Resource of type 'AWS::LakeFormation::TagAssociation' with identifier 'ResourceModel(resource=Resource(catalog=null, database=DatabaseResource(catalogId=catalogId, name=database_name), table=TableResource(catalogId=catalogId, databaseName=database_name, name=table_name, tableWildcard=null), tableWithColumns=null), lFTags=[LFTagPair(catalogId=catalogId, tagKey=tagKey, tagValues=[tagValue])], resourceIdentifier=null, tagsIdentifier=null)' did not stabilize." (RequestToken: token, HandlerErrorCode: NotStabilized)

The tag and valee do exist in LF. Database and table get deployed at an earlier moment in the stack. The documentation suggests to wait as this might be a timeout but i keep getting this error for a hour now so i'm pretty sure it's something else that a timeout.

Expected Behavior

Stack gets deployed and tag association in LF is visible in aws console

Current Behavior

above stack trace is printed

Reproduction Steps

run the given code

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.86.0 (build 1130fab)

Framework Version

No response

Node.js Version

v18.16.1

OS

macos

Language

Python

Language Version

Python 3.10.12

Other information

No response

[peterwoodworth]

Could you please share how this resource is synthesized in the template? I'm not able to reproduce this, but I'm supplying dummy values. However, I would bet that this error should throw before it is able to detect that my dummy values

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[plazmakeks]

hey peter. thanks for your reply and sorry for my sloppiness. i meanwhile stripped my complete deployment down to this single stack. i added dependencies between the components as sometimes the table was created before the database. seems CDK had problems handling that implicitly. here's the template:

{
 "Resources": {
  "database": {
   "Type": "AWS::Glue::Database",
   "Properties": {
    "CatalogId": "catalogId",
    "DatabaseInput": {
     "Name": "database"
    }
   },
   "Metadata": {
    "aws:cdk:path": "constructId/database"
   }
  },
  "table": {
   "Type": "AWS::Glue::Table",
   "Properties": {
    "CatalogId": "catalogId",
    "DatabaseName": "database",
    "TableInput": {
     "Name": "table",
     "Parameters": {
      "classification": "parquet"
     },
     "PartitionKeys": [],
     "StorageDescriptor": {
      "Columns": [
       {
        "Comment": "",
        "Name": "column",
        "Type": "date"
       }
      ],
      "InputFormat": "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat",
      "Location": "s3://my-bucket/my-prefix/",
      "OutputFormat": "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat",
      "SerdeInfo": {
       "SerializationLibrary": "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
      }
     },
     "TableType": "EXTERNAL_TABLE"
    }
   },
   "DependsOn": [
    "database"
   ],
   "Metadata": {
    "aws:cdk:path": "constructId/table"
   }
  },
  "DataNetErebusLaToTalLFTagAssociationdev": {
   "Type": "AWS::LakeFormation::TagAssociation",
   "Properties": {
    "LFTags": [
     {
      "CatalogId": "catalogId",
      "TagKey": "LFTagKey",
      "TagValues": [
       "LFTagValue"
      ]
     }
    ],
    "Resource": {
     "Database": {
      "CatalogId": "catalogId",
      "Name": "database"
     },
     "Table": {
      "CatalogId": "catalogId",
      "DatabaseName": "database",
      "Name": "table"
     }
    }
   },
   "DependsOn": [
    "database",
    "table"
   ],
   "Metadata": {
    "aws:cdk:path": "constructId/TagAssociation"
   }
  },
  "CDKMetadata": {
   "Type": "AWS::CDK::Metadata",
   "Properties": {
    "Analytics": "v2:deflate64:<some maybe sensitive string>"
   },
   "Metadata": {
    "aws:cdk:path": "constructId/CDKMetadata/Default"
   },
   "Condition": "CDKMetadataAvailable"
  }
 },
 "Conditions": {
  "CDKMetadataAvailable": {
   "Fn::Or": [
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "af-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-northeast-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-northeast-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ca-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "cn-north-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "cn-northwest-1"
       ]
      }
     ]
    },
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-north-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-3"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "me-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "sa-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-east-2"
       ]
      }
     ]
    },
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-west-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-west-2"
       ]
      }
     ]
    }
   ]
  }
 },
 "Parameters": {
  "BootstrapVersion": {
   "Type": "AWS::SSM::Parameter::Value<String>",
   "Default": "/cdk-bootstrap/hnb659fds/version",
   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
  }
 },
 "Rules": {
  "CheckBootstrapVersion": {
   "Assertions": [
    {
     "Assert": {
      "Fn::Not": [
       {
        "Fn::Contains": [
         [
          "1",
          "2",
          "3",
          "4",
          "5"
         ],
         {
          "Ref": "BootstrapVersion"
         }
        ]
       }
      ]
     },
     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
    }
   ]
  }
 }
}

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[plazmakeks]

the issue here was that the role deploying the tag association had no permissions on that tag. once there was granted it worked.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[ElevateAI]

Having the same error, I tried to add the permissions but still getting this error. Which permissions did you add?