CloudFormation Refs do not always map to the CCAPI id

[corymhall]

What happened?

CloudFormation has two ways of referencing attributes from a Resource. You can either use Ref or Fn::GetAtt.

The Ref is essentially a shortcut to get you the attribute that represents the CloudFormation Id of the resource. In the case of this library we are converting CloudFormation to CCAPI and we are currently assuming that the CloudFormation Ref is always the same as the CCAPI Identifier, but it turns out that is not always the case, especially for resources that have a CCAPI Identifier made up of multiple attributes.

Example

Take this CloudFormation template.

"Resources": {
    "RestApi": {
       "Type": "AWS::ApiGateway::RestApi",
       "Properties": {},
    },
    "ApiResource": {
       "Type": "AWS::ApiGateway::Resource",
       "Properties": {
          "RestApiId": {
           "Ref": "RestApi"
          }
       },
      },
      "ApiMethod": {
         "Type": "AWS::ApiGateway::Method",
         "Properties": {
            "ResourceId": {
             "Ref": "ApiResource"
            },
            "RestApiId": {
             "Ref": "Api"
            }
         }
    }
}

The ResourceId property of the AWS::ApiGateway::Method resource uses a Ref to the AWS::ApiGateway::Resource resource. CloudFormation will return the ResourceId from Ref. If we look at wha the CCAPI resource looks like:

{
    "Identifier": "xzpvi0s9e2|58778h",
    "Properties": "{\"ParentId\":\"aenyy5u7il\",\"PathPart\":\"api\",\"ResourceId\":\"58778h\",\"RestApiId\":\"xzpvi0s9e2\"}"
},

The Identifier is a reference to the primaryIdentifier which is a composite id made up of the ${RestApiId}|${ResourceId} and is not the same as what will be returned by CloudFormation Ref.

For the Method resource, the CCAPI Identifier is not the correct value for the ResourceId property. It should be using the ResourceId attribute of the Resource resource.

Output of pulumi about

N/A

Additional context

If we had access to the CloudFormation schema for the AWS::ApiGateway::Resource resource

https://github.com/pulumi/pulumi-aws-native/blob/cf710320d32c3b59067b81582ba8ff239bc4e452/aws-cloudformation-schema/aws-apigateway-resource.json#L31-L36

We may be able to make an assumption that if the primaryIdentifier is a composite identifier then we only take those values that also exist in the readOnlyAttributes.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[cleverguy25]

Added to epic https://github.com/pulumi/home/issues/2191

[t0yv0]

Related: pulumi/pulumi-aws-native#1662

[t0yv0]

Possibly related: pulumi/pulumi-aws-native#1734