[lambda] Lambda Layers with the same logical id in different stacks create only a single Lambda Layer

[SZubarev]

When I have two stacks and each stack deploys lambda layer with the same logical name CDK deploys only one lambda layer until logical names are made different. I would expect to have the layers prefixed with the stacks names (similar to Lambda functions) and two independent lambda layers deployed in this case.

Reproduction Steps

N/A

Error Log

No errors, just getting one layer instead of separate copies for each stack.

Environment

• CLI Version : 1.47.0
• Framework Version:
• Node.js Version: v14.4.0
• OS : MacOS 10.14.6
• Language (Version): TypeScript

Other

---

This is 🐛 Bug Report

[nija-at]

This difference in behaviour is not coming from the CDK.

It's coming from either CloudFormation or the Lambda backend. In both cases, layers or functions, we treat them the exact same way by not passing the name property when not specified.

Perhaps this is something we can hide under the CDK and make it a little better for the user.

[nija-at]

Internal ref: tt/0503389452

[github-actions[bot]]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[SamStephens]

Commenting; this is still a nasty little issue. Potentially it should be solved at the Cloudformation level, as this is also a problem for people using Cloudformation directly.

[madeline-k]

I agree with some prior comments in this thread, it should be solved at the Cloudformation level. It's not ideal, but you can avoid this problem by specifying the layerVersionName property, or by specifying different construct ids (which will result in different logical ids).

I am going to convert this to a discussion so that people can find this info if they hit this behavior.

[SamStephens]

Wherever this belongs, it's definitely not a Q&A discussion - if you're going to make it a discussion it should be in General.

If this issue should be solved at the Cloudformation level, has a bug been raised against the team? Has it been prioritised?

I urge AWS to take it seriously, a customer is going to be badly hurt at some stage. The following example is easy to imagine:

• Customer consumes a dependency via a layer in an important production application.
• A developer consumes the same dependency in a layer of the same name in a toy/test application.
• There is a security issue in the dependency.
• The production application has its dependency updated to a version with the security issue fixed.
• The dependency in the toy application is not updated, because it's not customer facing or important.
• The toy application is deployed. In the process, the layer is overwritten with an insecure version of the dependency.
• All attempts to audit the code of the production application show the application as being secure.
• However actually what is deployed for the production application is now insecure.

This is a dreadful situation, with the core problem being that Cloudformation is violating the separation of resources between applications.

I think you've been hasty in saying this will not be fixed in the CDK; there is precedent for CDK working around Cloudformation shortcomings, and it'll be difficult to fix at the Cloudformation level without a breaking change.