aws_cdk.triggers: When using a CDK stack containing a trigger, an exception is thrown if a tag is added from a SSM parameter.

[sheridansmall]

Describe the bug

When using a CDK stack containing a trigger, an exception is thrown if a tag is added from a SSM parameter.

The exception is:

CdkBugStack | 3/8 | 11:21:30 | CREATE_FAILED | AWS::IAM::Role | AWSCDK.TriggerCustomResourceProviderCustomResourceProvider/Role (AWSCDKTriggerCustomResourceProviderCustomResourceProviderRoleE18FAF0A) Resource handler returned message: "1 validation error detected: Value '${Token[TOKEN.15]}' at 'tags.1.member.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\p{L}\p{Z}\p{N}_.:/=+-@]* (Service: Iam, Status Code: 400, Request ID: c8c9ca37-592a-4e87-b7a1-5a0a5a7cd750)" (RequestToken: 22ce585d-ad32-1183-9110-e92c209c6d32, HandlerErrorCode: GeneralServiceException)

Expected Behavior

I would expect the stack to deploy with all resources tagged with the tag

Current Behavior

An exception is thrown

Failed resources:
CdkBugStack | 11:21:30 | CREATE_FAILED | AWS::IAM::Role | AWSCDK.TriggerCustomResourceProviderCustomResourceProvider/Role (AWSCDKTriggerCustomResourceProviderCustomResourceProviderRoleE18FAF0A) Resource handler returned message: "1 validation error detected: Value '${Token[TOKEN.15]}' at 'tags.1.member.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\p{L}\p{Z}\p{N}_.:/=+-@]* (Service: Iam, Status Code: 400, Request ID: c8c9ca37-592a-4e87-b7a1-5a0a5a7cd750)" (RequestToken: 22ce585d-ad32-1183-9110-e92c209c6d32, HandlerErrorCode: GeneralServiceException)

❌ CdkBugStack failed: Error: The stack named CdkBugStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "1 validation error detected: Value '${Token[TOKEN.15]}' at 'tags.1.member.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\p{L}\p{Z}\p{N}_.:/=+-@]* (Service: Iam, Status Code: 400, Request ID: c8c9ca37-592a-4e87-b7a1-5a0a5a7cd750)" (RequestToken: 22ce585d-ad32-1183-9110-e92c209c6d32, HandlerErrorCode: GeneralServiceException)
at FullCloudFormationDeployment.monitorDeployment (C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:471:10232)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:474:180228)
at async C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:474:163476

❌ Deployment failed: Error: The stack named CdkBugStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "1 validation error detected: Value '${Token[TOKEN.15]}' at 'tags.1.member.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\p{L}\p{Z}\p{N}_.:/=+-@]* (Service: Iam, Status Code: 400, Request ID: c8c9ca37-592a-4e87-b7a1-5a0a5a7cd750)" (RequestToken: 22ce585d-ad32-1183-9110-e92c209c6d32, HandlerErrorCode: GeneralServiceException)
at FullCloudFormationDeployment.monitorDeployment (C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:471:10232)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:474:180228)
at async C:\NVM\v18.16.0\node_modules\aws-cdk\lib\index.js:474:163476

The stack named CdkBugStack failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "1 validation error detected: Value '${Token[TOKEN.15]}' at 'tags.1.member.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\p{L}\p{Z}\p{N}_.:/=+-@]* (Service: Iam, Status Code: 400, Request ID: c8c9ca37-592a-4e87-b7a1-5a0a5a7cd750)" (RequestToken: 22ce585d-ad32-1183-9110-e92c209c6d32, HandlerErrorCode: GeneralServiceException)

Reproduction Steps

Deploy the stack:

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        tag_value = aws_ssm.StringParameter.from_string_parameter_attributes(
            self,
            "tag_value",
            parameter_name="/my_existing_param"
        ).string_value

        Tags.of(self).add("my_tag", tag_value)

        func = aws_lambda.Function(
            self,
            "MyFunction",
            handler="index.handler",
            runtime=aws_lambda.Runtime.NODEJS_18_X,
            code=aws_lambda.Code.from_inline("foo")
        )

        triggers.Trigger(
            self,
            "trigger",
            handler=func,
            timeout=Duration.minutes(10),
            invocation_type=triggers.InvocationType.EVENT
        )

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.105.0 (build 04cb52d)

Framework Version

No response

Node.js Version

v18.18.2

OS

Windows Linux

Language

Python

Language Version

Python 3.9.13

Other information

No response

[pahud]

probably related to #28017

[rix0rrr]

It shouldn't be about the trigger. This can never work. You can apply tags like this to the resources, but not to the stack.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.