AWS CustomeResource 卡在更新过程中

Question

I have tried to use the lambda function to fetch some value from the SSM and supply to it through the EC2 at instance creation through UserData. I have stuck at the process as it is Stuck at the CREATE_IN_PROGRESS stage. Lambda function is created and it returns the value that i want when i run test through amazon console but customeresource is stuck.

    Type: AWS::Lambda::Function
    Properties:
      FunctionName: "GetKeyFunction"
      Handler: "index.handler"
      Runtime: "python3.6"
      Timeout: 5
      Role: !GetAtt LamdaExecutionRole.Arn
      Code:
        ZipFile: |
          import boto3
          
          def handler(event, context):
            ssm = boto3.client('ssm')
            response = ssm.get_parameter(Name='private_key', WithDecryption=True)
            key = response['Parameter']['Value']
            return key
    
  KeyCustomeResource:
    Type: Custom::LamdaInvoker
    DependsOn: LambdaFunction
    Properties:
      ServiceToken: !GetAtt LamdaFunction.Arn

But the KeyCustomeResource is stuck at CREATE_IN_PROGRESS. I am pretty new to python and AWS both. I cannot figure what is missing in it?

Thank You

Answer 1

Your custom resource is stuck because Cloudformation does not know if it is deployed successfully or not. It will eventually timeout and you'll be able to delete it manually.

To work correctly, in your lambda function you need to return a SUCCESS or FAILED status to Cloudformation and your 'key' in the Data field like this:

response_data = {
    'Status': 'SUCCESS',
    'StackId': event['StackId'],
    'RequestId': event['RequestId'],
    'LogicalResourceId': event['LogicalResourceId'],
    'PhysicalResourceId': str(uuid.uuid4()) if event['RequestType'] == 'Create' else event['PhysicalResourceId'],
    'Data': {
        'Key': response['Parameter']['Value']
    }
}

return response_data

Similarly you'll need to send a Status:FAILED and a ['Data']['Reason'] if lambda fails or exceptions out - to help Cloudformation rollback or delete smoothly

You can access your 'key' in your template using a Cloudformation GetAtt like so: PrivateKey: .GetAtt KeyCustomeResource.Key