CfnMapping: Error when deploying template with mapping default value

[drobbins-ancile]

Describe the bug

When attempting to deploy a stack that was successfully synthesized using the following code:

self.add_transform("AWS::LanguageExtensions")

...

ipset_mapping = CfnMapping(
    self,
    "IpSetMapping",
    mapping={
        "us-east-1": {
            "Beta": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
            "Preview": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Preview-NatGateway-IPs/db157747-175a-40ae-b780-d2e8cb6af7f4",
            "Prod": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Prod-NatGateway-IPs/39b48ae3-d224-4bc3-87cf-c6827ce15d5d",
        },
        "ca-central-1": {
            "Prod": "arn:aws:wafv2:ca-central-1:<account id>:regional/ipset/Prod-NatGateway-IPs/4523362c-c473-4e8b-8068-cb3a2dadb0bd",
        },
        "eu-central-1": {
            "Prod": "arn:aws:wafv2:eu-central-1:<account id>:regional/ipset/Prod-NatGateway-IPs/fdb0fdfe-e479-4216-be04-bfafa9cc329b",
        },
        "ap-southeast-2": {
            "Prod": "arn:aws:wafv2:ap-southeast-2:<account id>:regional/ipset/Prod-NatGateway-IPs/c07a88f7-1b9b-4e1c-97e0-07a4c711631e"
        },
    },
)

...


ip_set_scope_down_statement = wafv2.CfnWebACL.StatementProperty(
    not_statement=wafv2.CfnWebACL.NotStatementProperty(
        statement=wafv2.CfnWebACL.StatementProperty(
            ip_set_reference_statement=wafv2.CfnWebACL.IPSetReferenceStatementProperty(
                arn=ipset_mapping.find_in_map(
                    Fn.sub("${AWS::Region}"),
                    environment.value_as_string,
                    "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
                )
            )
        )
    )
)

The synthesized template shows:

 "Transform": [
  "AWS::LanguageExtensions"
 ],

...

"Mappings": {
  "IpSetMapping": {
   "us-east-1": {
    "Beta": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
    "Preview": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Preview-NatGateway-IPs/db157747-175a-40ae-b780-d2e8cb6af7f4",
    "Prod": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Prod-NatGateway-IPs/39b48ae3-d224-4bc3-87cf-c6827ce15d5d"
   },
   "ca-central-1": {
    "Prod": "arn:aws:wafv2:ca-central-1:<account id>:regional/ipset/Prod-NatGateway-IPs/4523362c-c473-4e8b-8068-cb3a2dadb0bd"
   },
   "eu-central-1": {
    "Prod": "arn:aws:wafv2:eu-central-1:<account id>:regional/ipset/Prod-NatGateway-IPs/fdb0fdfe-e479-4216-be04-bfafa9cc329b"
   },
   "ap-southeast-2": {
    "Prod": "arn:aws:wafv2:ap-southeast-2:<account id>:regional/ipset/Prod-NatGateway-IPs/c07a88f7-1b9b-4e1c-97e0-07a4c711631e"
   }
  }
 },

...

         "scopeDownStatement": {
           "notStatement": {
            "statement": {
             "ipSetReferenceStatement": {
              "arn": {
               "Fn::FindInMap": [
                "IpSetMapping",
                {
                 "Fn::Sub": "${AWS::Region}"
                },
                {
                 "Ref": "Environment"
                },
                {
                 "DefaultValue": "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45"
                }
               ]
              }
             }
            }
           }
          }

The change set validation/stack deployment fails with Template error: every Fn::FindInMap object requires three parameters, the map name, map key and the attribute for return value.

I have also tried adding the map name:

ipset_mapping.find_in_map(
					"IpSetMapping",
                    Fn.sub("${AWS::Region}"),
                    environment.value_as_string,
                    "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
                )

According to the documentation my code appears to be correct.

Expected Behavior

The synthesized stack deploys successfully.

Current Behavior

The change set validation/stack deployment fails with Template error: every Fn::FindInMap object requires three parameters, the map name, map key and the attribute for return value.

Reproduction Steps

Synthesize and attempt to deploy a template using code similar to:

ipset_mapping.find_in_map(
                    Fn.sub("${AWS::Region}"),
                    environment.value_as_string,
                    "arn:aws:wafv2:us-east-1:<account id>:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45",
                )

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.115.0 (build 58027ee)

Framework Version

No response

Node.js Version

21.4.0

OS

MacOS

Language

Python

Language Version

3.12.0

Other information

No response

[pahud]

I didn't see the definition of your environment and it could due to not resolvable.

What if you change the environment to a static value? Does it work?

[pahud]

btw, I noticed you are using node v21 which we haven't fully tested and we've seen some issues with v21. I would highly recommend fall back to v20 instead.

[drobbins-ancile]

I didn't see the definition of your environment and it could due to not resolvable.

What if you change the environment to a static value? Does it work?

Apologies for not including it in the original code snipppets. environment is a cloudformation stack parameter:

environment = CfnParameter(self, "Environment")

In the synthesized template it appears to be correct:

"Fn::FindInMap": [
  "IpSetMapping",
  {
   "Fn::Sub": "${AWS::Region}"
  },
  {
   "Ref": "Environment" <- here
  },
  {
   "DefaultValue": "arn:aws:wafv2:us-east-1:638051133977:regional/ipset/Beta-NatGateway-IPs/a2d011ef-1756-4563-9466-ad5615420c45"
  }
 ]

[pahud]

Did you mean it synthesized correct but when you deploy, CFN fails with error?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[drobbins-ancile]

Did you mean it synthesized correct but when you deploy, CFN fails with error?

Correct.