aws_appconfig, cdk.Fn.import_value: Error: Missing required parameters for environment ARN: format should be /$/{applicationId}/environment//$/{environmentId}

[vivekrpatel8]

Describe the bug

I am creating environment for my AWS App Config using

environment = app.add_environement(id, environment_name)
cdk.CfnOutput(self, "EnvArn", export_name="EnvArn", value=environment.environment_arn)

I am using static method which returns the environment using ARN:

env_arn = cdk.Fn.import_value("EnvArn")
env = Environment.from_environment_arn(scope, construct_id, environment_arn = env_arn)

but getting following error: @jsii/kernel.RuntimeError: Error: Missing required parameters for environment ARN: format should be /$/{applicationId}/environment//$/{environmentId}

Regression Issue

• [ ] Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

It should return environment

Current Behavior

It is throwing error as mentioned

Reproduction Steps

Create environment and try to import it as mentioned in the description

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.154.1

Framework Version

No response

Node.js Version

20.0.0

OS

Windows

Language

Python

Language Version

No response

Other information

No response

[khushail]

Hi @vivekrpatel8 , thanks for reaching out.

Not really clear of at which code you are getting the error but AFAIU, here is an AWS Doc which lists out the requirements for Fn:Import.

Looks like you are implementing this as cross-stack reference, I tried to print the arn in first stack just to confirm what is the output value being printed which should be -/$/{applicationId}/environment//$/{environmentId}

Could you please see if the first CfnOutput value corresponds to the format before import. Also please share the complete code to repro the issue. Thanks.

[vivekrpatel8]

@khushail Yeah exactly lets say I have two stacks... One stack is responsible for provisioning the infra for AppConfig such as creating application and environments. Other stack is a CodePipeline which adds and deploys HostedConfiguration for given app and environment. I tried to run cdk diff, but the output I get is not complete ARN but rather the components of ARN

{"Value":{"Fn::Join":["",["arn:aws:appconfig:us-west-1:random_numbers:application/",{"Ref":"App_ID"}]]},"Export":{"Name":"AppConfigAppArn"}}

[vivekrpatel8]

@khushail My code looks something like this:

class AppConfigExample(construct):
    def __init__(self, scope: Construct, construct_id: str, **kwargs):
        super().__init__(scope, construct_id, **kwargs)

        app = self.create_app()

        # Consider env_config as a list of objects with name attribute such as [{'name': 'example-env-1'}, {'name': 'example-env-2'}]
        for env in env_config:
            environment = self._create_environment(app=app, env=env)
    
    def create_app(self) -> Application:
        app = Application(self, "AppConfig", application_name="AppConfigExample")
        cdk.CfnOutput(self, "ExampleAppArn", export_name="ExampleAppArn", value=app.application_arn)
        return app

    def _create_environment(self, app: Application, env: dict) -> IEnvironment:
        environment = app.add_environment(f"{env.name}-AppConfigExampleEnv", environment_name=env.name)
        cdk.CfnOutput(self, f"{env.name}ExampleEnvArn", export_name=f"{env.name}ExampleEnvArn", value=environment.environment_arn)
        return environment
    
    @staticmethod
    def import_app_config_app(scope: Construct, construct_id: str) -> IApplication:
        app_arn = cdk.Fn.import_value("ExampleAppArn")
        return Application.from_application_arn(scope, construct_id, application_arn=app_arn)

    @staticmethod
    def import_app_config_env(scope: Construct, construct_id: str, env_name: str) -> IEnvironment:
        env_arn = cdk.Fn.import_value(f"{env_name}ExampleEnvArn")
        return Environment.from_environment_arn(scope, construct_id, environment_arn=env_arn)
    
class SomeOtherStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        app = AppConfigExample.import_app_config_app(self, "AppConfigExample")

        for env in env_config:
            environment = AppConfigExample.import_app_config_env(self, f"{env.name}AppConfigExampleEnv", env_name=env.name)
            app.add_hosted_configuration(
                f"{env.name}-HostedConfig",
                name=f"{env.name}-ExampleHostedConfig",
                deploy_to=[environment],
                type=ConfigurationType.FREEFORM,
                content=ConfigurationContent.from_file(file_name)
            )

[khushail]

Hi @vivekrpatel8 , thanks for sharing the code.

I used my above exported value in another stack and got the same error -

AFAIU, this code here is checking the Arn during fromEnvironmentArn()- https://github.com/aws/aws-cdk/blob/b0e4a544aecce86e8b41e7cd148a139c2e34bfbd/packages/aws-cdk-lib/aws-appconfig/lib/environment.ts#L190

which is invoking this code to check the resource name being imported - https://github.com/aws/aws-cdk/blob/b0e4a544aecce86e8b41e7cd148a139c2e34bfbd/packages/aws-cdk-lib/core/lib/arn.ts#L41

https://github.com/aws/aws-cdk/blob/b0e4a544aecce86e8b41e7cd148a139c2e34bfbd/packages/aws-cdk-lib/aws-appconfig/lib/environment.ts#L190C1-L194C3

  public static fromEnvironmentArn(scope: Construct, id: string, environmentArn: string): IEnvironment {
    const parsedArn = Stack.of(scope).splitArn(environmentArn, ArnFormat.SLASH_RESOURCE_NAME);
    if (!parsedArn.resourceName) {
      throw new Error(`Missing required /$/{applicationId}/environment//$/{environmentId} from environment ARN: ${parsedArn.resourceName}`);
  

Looks like the condition is triggering invocation of printed error message. let me investigate more and get back to you.

[vivekrpatel8]

Hello @khushail! Thanks for looking into it. I tried to mimic this ARN split logic in my python code and I believe the below code block is the throwing the mentioned error:

I think the split logic is incorrect... So instead of using ArnFormat.SLASH_RESOURCE_NAME for retrieving the parsed ARN I tried using other options as well such as ArnFormat.SLASH_RESOURCE_SLASH_RESOURCE_NAME, COLON_RESOURCE_NAME, etc. but no luck! It still returns same error and when I split parsed ARN using resource_name = parsed_arn.resource_name.split('/') it always returns list with single value. But code tries to access index 2 for getting Environment ID which end up throwing IndexError: list index out of range error. Or it is also possible that incorrect ARN format is returned by environment.environment_arn.

[khushail]

@vivekrpatel8 , yes you seem to be correct in identifying the block code..

i double checked the generated Synth template to see what is the output of the arn value -

In the first stack , the output is -

"Outputs": {
  "EnvArn": {
   "Value": {
    "Fn::Join": [
     "",
     [
      "arn:aws:appconfig:us-east-1:123456789012:application/",
      {
       "Ref": "MyApp3CE31C26"
      },
      "/environment/",
      {
       "Ref": "Environment78414C64"
      }
     ]
    ]
   },
   "Export": {
    "Name": "EnvArn"
   }
  }

Since the 2nd stack which is importing this , is not getting synthesized, i am not sure how we could check into that imported value. So looks like, the error lies in the fromEnvironmentArn() function itself.

[khushail]

Marking this as P2 as it won't be immediately addressed by the team but would be on their radar.

I will bring this up to the team for their input if this is something we are actively investigating and share our thoughts here if possible.

[vivekrpatel8]

Thanks for the update @khushail

[khushail]

Requesting Core team's input on this issue as this is something being already addressed by the team or share insights on the debugging of issue. Thanks.

[GavinZZ]

Hello, when you use CfnOutput and Fn.ImportValue, the imported value is a unresolved token thus cannot be used for the from_environment_arn method as this function will parse the ARN but will fail due to unresolved token.

The recommended method is as follows:

# Stack A
class AppConfigExample(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        app = self.create_app()
        self.config_environment = self._create_environment(app) # Set as class property
        
    def create_app(self) -> Application:
        app = Application(self, "AppConfig")
        return app

    def _create_environment(self, app: Application) -> IEnvironment:
        environment = app.add_environment("AppConfigExampleEnv")
        return environment

# Stack B
class SomeOtherStack(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id)

        enviro = Environment.from_environment_arn(self, construct_id, kwargs['env_arn'])
        print(enviro.environment_arn)

# App 
app = cdk.App()
appConfigStack = AppConfigExample(app, "AppConfigExample")
otherStack = SomeOtherStack(app, "SomeOtherStack", env_arn = appConfigStack.config_environment.environment_arn)
app.synth()

[vivekrpatel8]

Hello @khushail Is there any way to replicate hosted configuration across multiple regions? Like replica_regions for secretmanager secrets?

[JBGed]

@GavinZZ What can we do if the ARN is managed in a different CDK application?