AWS Network firewall endpoint is not generated properly

Terraform CDK for Terraform
1

I’m currently using typescript for CDKTF, the below lines

 const firewall = new DataAwsNetworkfirewallFirewall(this, "test", {
      name: "firewall"
 });
firewall.firewallStatus.get(0).syncStates.get(0).attachment.get(0).endpointId;

seems to generate the following lines under cdk.tf.json

 "${tolist(data.aws_networkfirewall_firewall.test.firewall_status[0].sync_states)[0][\"attachment[0].endpoint_id\"]}"

in which ["attachment[0].endpoint_id"] is incorrect, the correct way to access should be

"${tolist(data.aws_networkfirewall_firewall.test.firewall_status[0].sync_states)[0].attachment[0].endpoint_id}"
2

Hi @waynechong1995 :wave:

This looks like a bug :bug:! Would you mind filing it in our repository over here?

I think that one might have to do with the underlying type of sync_states being a set, but the code you have should work :sweat_smile:

1 Like
3

@waynechong1995 Did you ever get around to resolving this? I’m running into the same issue.

4

There you go

Fn.lookup(
          Fn.element(networkFirewall.firewallStatus.get(0).syncStates.get(index).attachment.toString(), 0),
          'endpoint_id',
          ''
        );
5

Thanks alot for this Wayne. It looks like when you have more than 1 firewall endpoint, this resource is still problematic. The sync states look something like this:

            sync_states = [
                {
                    attachment        = [
                        {
                            endpoint_id = "vpce-031ed3c5d848"
                            subnet_id   = "subnet-0b6782fac271"
                        },
                    ]
                    availability_zone = "ap-south-1b"
                },
                {
                    attachment        = [
                        {
                            endpoint_id = "vpce-044aa97a9fb8"
                            subnet_id   = "subnet-032b155aadf6"
                        },
                    ]
                    availability_zone = "ap-south-1a"
                },
                {
                    attachment        = [
                        {
                            endpoint_id = "vpce-0a77b53c9bd7"
                            subnet_id   = "subnet-03472e827cc0"
                        },
                    ]
                    availability_zone = "ap-south-1c"
                },
            ]
        },

As you can see it’s un ordered so getting the endpoint id by index isn’t really great. I’ve tried something like:

      let vpcEndpointId: string | null = null; 

      for (let i = 0; i < 2; i++) {
        const syncState = this.nonProdFirewall.firewallStatus.get(0).syncStates.get(i);
      
        // Using the lookup function to get availability_zone
        const syncStateAZ = Fn.lookup(syncState.toString(), "availability_zone", "");
        
        if (syncStateAZ === this.prodFirewallSubnets[index].availabilityZone) {
          // Extract the endpoint_id when a match is found
          vpcEndpointId = Fn.lookup(Fn.element(syncState.attachment.toString(), 0), 'endpoint_id', '');
          break; // Exit the loop once you've found the match
        }
      }

No luck, any chance you’ve solved for this as well?