(aws-cdk-lib/custom-resources): L2 Provider construct generate circular dependency

[lmouhib]

Describe the bug

When passing a role to the Provider the construct is no longer able to deploy correctly and fails with a circular dependency between the functions and policies generated by the Provider.

At CDK deploy time the deployment fails with Circular dependency between resources:

this where the construct is defined

https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_custom-resources.Provider.html

Expected Behavior

The Provider should deploy with the provider role without CFN failing with Circular dependency between resources:

Current Behavior

The Provider fail deploying with Circular dependency between resources:

Reproduction Steps

1. Create a onEventHandler and isCompleteHandler Functions
2. Create a role with service principal as lambda.amazonaws.com
3. Create a Provider and pass to it the role and functions created above

Possible Solution

Fix the dependency on the Provider created resources.

Additional Information/Context

No response

CDK CLI Version

2.24.1 (build 585f9ca)

Framework Version

No response

Node.js Version

v14.17.6

OS

macOS Monterey

Language

Typescript

Language Version

4.1.6

Other information

No response

[lmouhib]

To reproduce the error clone/fork this repository

[lmouhib]

This is the actual error message

Circular dependency between resources: [customresourceproviderframeworkonTimeout03C9F325, customresourceproviderframeworkonEvent8A5AE2D2, customresourceproviderwaiterstatemachineRoleDefaultPolicy7AD89E4F, customresourceproviderframeworkisComplete934E4E18, customresourceproviderwaiterstatemachineBC63D394, providerRoleDefaultPolicy70D60963]

[lmouhib]

if we comment isCompleteHandler the construct deploys without issue

[atali]

I got the following :

Stack Deployments Failed: ValidationError: Circular dependency between resources: [CloudSearchDomainRoleDefaultPolicyD495E4C7, CloudSearchDomainCustomResourceE2BABF82, CloudSearchDomainProviderframeworkonTimeout333FF4AE, CloudSearchDomainProviderwaiterstatemachineRoleDefaultPolicy831754FB, CloudSearchDomainProviderframeworkisComplete94D623D4, CloudSearchDomainProviderwaiterstatemachine21988061, CloudSearchDomainProviderframeworkonEvent4A6BA2ED]

[nisaacson]

you can work around this by manually defining the provider role, granting the required permissions and then calling withoutPolicyUpdates on the role. See https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Role.html#withoutwbrpolicywbrupdatesoptions for more details