cdk migrate: cdk migrate fails with "unreachable" error when template includes "AWS::RDS::DBCluster" that specifies the "ReadEndpoint" property

[nelomsmn]

Describe the bug

When using the "cdk migrate" command to migrate an existing template that includes an "AWS::RDS::DBCluster" resource, the command fails if the resource includes the "ReadEndpoint" property. Please see the error below:

cdk migrate --from-path './CDKMigrateExampleTemplate.yml' --stack-name CustomStackName
...
 ❌  Migrate failed for `CustomStackName`: stack generation failed due to error 'unreachable'

stack generation failed due to error 'unreachable'

This issue also occurs when attempting to migrate an "AWS::RDS::DBSecurityGroup" resource when the "DBSecurityGroupIngress" property is specified.

Expected Behavior

We are expecting cdk migrate to support all properties for the "AWS::RDS::DBCluster" resource as this resource is supported by IaC Generator

Current Behavior

Migration command fails when the template includes an "AWS::RDS::DBCluster" that specifies the "ReadEndpoint" property. Commenting out the property results in a successful template migration.

Reproduction Steps

Step 1: Use the below template with the cdk migrate command (should result in a successful run)
Step 2: Uncomment the "ReadEndpoint" property and retry the migrate command

Resources:
  Cluster:
    Type: AWS::RDS::DBCluster
    Properties:
      AllocatedStorage: 0
      AssociatedRoles: 
        - DBClusterRole
      AutoMinorVersionUpgrade: false
      AvailabilityZones: 
        - String
      BacktrackWindow: 0
      BackupRetentionPeriod: 0
      CopyTagsToSnapshot: false
      DatabaseName: String
      DBClusterIdentifier: String
      DBClusterInstanceClass: String
      DBClusterParameterGroupName: String
      DBInstanceParameterGroupName: String
      DBSubnetGroupName: String
      DBSystemId: String
      DeletionProtection: false
      Domain: String
      DomainIAMRoleName: String
      EnableCloudwatchLogsExports: 
        - String
      EnableGlobalWriteForwarding: false
      EnableHttpEndpoint: false
      EnableIAMDatabaseAuthentication: false
      Engine: String
      EngineMode: String
      EngineVersion: String
      GlobalClusterIdentifier: String
      Iops: 0
      KmsKeyId: String
      ManageMasterUserPassword: false
      MasterUsername: String
      MasterUserPassword: String
      MasterUserSecret: 
        MasterUserSecret
      MonitoringInterval: 0
      MonitoringRoleArn: String
      NetworkType: String
      PerformanceInsightsEnabled: false
      PerformanceInsightsKmsKeyId: String
      PerformanceInsightsRetentionPeriod: 0
      Port: 0
      PreferredBackupWindow: String
      PreferredMaintenanceWindow: String
      PubliclyAccessible: false
      # ReadEndpoint: 
      #   Address: String
      ReplicationSourceIdentifier: String
      RestoreToTime: String
      RestoreType: String
      ScalingConfiguration: 
        ScalingConfiguration
      ServerlessV2ScalingConfiguration: 
        ServerlessV2ScalingConfiguration
      SnapshotIdentifier: String
      SourceDBClusterIdentifier: String
      SourceRegion: String
      StorageEncrypted: false
      StorageType: String
      Tags: 
        - Tag
      UseLatestRestorableTime: false
      VpcSecurityGroupIds: 
        - String

Possible Solution

N/a

Additional Information/Context

When creating a template for existing "AWS::RDS::DBCluster" within IaC generator, the "ReadEndpoint" property is always included in the generated template(even if empty). Thus, newly generated templates also present the "unreachable" error.

CDK CLI Version

1.128.0

Framework Version

No response

Node.js Version

v18

OS

MacOs

Language

TypeScript

Language Version

Occurs when generating templates in all languages

Other information

No response

[tim-finnigan]

Thanks for reporting, I could reproduce the issue. It looks like specifically the Address: String part of ReadEndpoint is causing this to fail. The only other place I found that error reported was in #27709, which was about cdk migrate tests failing - but that issue was closed without more info.

[TheRealAmazonKendra]

Looks like the issue here is that ReadEndpoint is actually a readonly property and should only be listed as an attribute, not as a property in the CloudFormation template. Since CDK handles it as a readonly property, it doesn't exist in the CDK props. I'll need to reach out to CloudFormation to get this one fixed on their end.

[TheRealAmazonKendra]

In addition to reaching out to CloudFormation for this fix, we have improved our error handling so a better error message is returned cdklabs/cdk-from-cfn#594. I will close this issue once the most up-to-date version of cdk-from-cfn is merged into the aws-cdk.

[TheRealAmazonKendra]

We have released an update to improve the error handling and that change is available as of v2.132. As for the field itself, we are awaiting action from CloudFormation.