(CDK CLI): Migrate command failed with an internal error

[vincetran]

Describe the bug

I'm attempting to use the --from-scan option when running cdk migrate and the template creation failed with an internal error with no signs of what went wrong.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

N/A

Expected Behavior

For the template to be created and a CDK created

Current Behavior

CLI Output:

This command is an experimental feature.
Starting new scan for account unknown-account in region unknown-region
Resource scan in progress. Please wait, this can take 10 minutes or longer.
[████████████████████████████] (100%)
✅ Scan Complete!
Using the latest successful scan which is 0 days, 0 hours, and 5 minutes old.
No filters provided. Retrieving all resources from scan.
finding related resources.
Found 269 resources.
Generating CFN template from scanned resources.
Please wait, template creation in progress. This may take a couple minutes.
[CREATE_IN_PROGRESS] Template Creation in Progress ❌  Migrate failed for `MY_STACK_NAME`: Internal Error

When I look at the CloudFormation IaC generator template, the definition tab says
"See template resources for details of the failure."

and when I check the Template Resources tab, I see 269 resources and the template status for all of them is COMPLETE. The Template Generation Status is Failed - Internal Error

Reproduction Steps

Command ran:

cdk migrate --stack-name MY_STACK_NAME --output-path OUTPUT_DIR --from-scan new

Possible Solution

No response

Additional Information/Context

Template ID: arn:aws:cloudformation:us-west-2:703889496698:generatedTemplate/eed6eec7-7304-4157-9e7c-6fdfd410f61f

CDK CLI Version

2.1004.0 (build f0ad96e)

Framework Version

No response

Node.js Version

v18.19.0

OS

macOS

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Analysis

1. The issue occurs in the generateTemplate function in packages/aws-cdk/lib/commands/migrate.ts
2. Key findings from the code:

• The scan completes successfully and finds 269 resources
• The template generation process starts but fails with an internal error
• All resources show COMPLETE status but the overall template generation fails

The specific issue appears to be in this code flow:

// From migrate.ts
async function generateTemplate(options: GenerateTemplateOptions): Promise<GenerateTemplateOutput> {
  // ... scan completes successfully ...

  info('Generating CFN template from scanned resources.');
  const templateArn = (await cfn.createGeneratedTemplate(options.stackName, relatedResources)).GeneratedTemplateId!;

  let generatedTemplate = await cfn.describeGeneratedTemplate(templateArn);

  info('Please wait, template creation in progress. This may take a couple minutes.');
  while (generatedTemplate.Status !== ScanStatus.COMPLETE && generatedTemplate.Status !== ScanStatus.FAILED) {
    await printDots(`[${generatedTemplate.Status}] Template Creation in Progress`, 400);
    generatedTemplate = await cfn.describeGeneratedTemplate(templateArn);
  }
}

The failure occurs after successfully scanning the resources but during the template generation phase. The unusual aspect is that all individual resources show as COMPLETE but the overall template generation fails. This suggests that while each resource can be processed individually, there may be:

1. Conflicts in resource dependencies or relationships
2. Issues with write-only properties that couldn't be resolved
3. Incompatible resource configurations that prevent template synthesis

This seems to be a bug in AWS CloudFormation's IaC template generator service rather than in the CDK CLI code itself, as the error comes from the CloudFormation service response.

Reaching out to the team for more inputs.

[iliapolo]

Yes, this appears to be an issue with the IaC generator rather than with CDK. Since the generator doesn't return the actual error, we have no way of knowing whether CDK can do something about it, so this is not currently actionable by us.

Once the root cause is known, we can see if CDK is able to help by either failing early, or maybe even auto-correcting the scan. I suggest reaching out to AWS support for further investigation of the specific template.