如何在AWS CDK同堆栈中为S3桶策略与事件通知添加依赖？

问题场景 #

使用AWS CDK部署配置了权限的S3桶，并为该桶添加已有SNS主题的对象删除事件通知时，部署报错：

Resource handler returned message: "A conflicting conditional operation is currently in progress against this resource. Please try again.

通过CloudTrail排查发现，PutBucketPolicy（添加非SSL访问拒绝策略）和PutBucketNotification（配置SNS事件通知）两个操作并发执行，针对同一S3桶引发资源冲突。

解决方案 #

通过为桶通知配置添加显式依赖，确保PutBucketNotification操作在PutBucketPolicy完成后再执行，即可解决并发冲突问题。修改后的代码如下：

const bucket = new BaseS3Bucket(this, "bucket", {
  versioned: true,
  enforceSSL: true,
  bucketName: this.bucketName,
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
  accessControl: options.setAccessControl !== false ? s3.BucketAccessControl.PRIVATE : undefined,
  publicReadAccess: false,
  encryption: s3.BucketEncryption.KMS_MANAGED,
  serverAccessLogsBucket: logBucket,
  serverAccessLogsPrefix: 'deployment-logs',
  lifecycleRules: [
    {
      id: 'NonCurrentVersionRule',
      enabled: true,
      noncurrentVersionExpiration: cdk.Duration.days(BucketCdkStack.NON_CURRENT_VERSION_EXPIRATION_DAY),
    },
  ],
});

const topic = cdk.aws_sns.Topic.fromTopicArn(
  this,
  "topic",
  topicArn,
);

// 确保桶策略依赖于SNS主题（若策略中需引用主题则保留，否则可省略）
bucket.policy?.node.addDependency(topic);

// 添加事件通知并获取对应的CFN底层资源
const snsDestination = new cdk.aws_s3_notifications.SnsDestination(topic);
const notification = bucket.addEventNotification(s3.EventType.OBJECT_REMOVED_DELETE, snsDestination);
const cfnBucketNotification = notification.node.defaultChild as cdk.aws_s3.CfnBucketNotification;

// 为桶通知添加依赖：必须等待桶策略部署完成后再执行
if (bucket.policy) {
  cfnBucketNotification.node.addDependency(bucket.policy);
}

关键修改说明 #

1. 获取桶通知的CFN底层资源：通过notification.node.defaultChild获取CDK封装后的CfnBucketNotification资源，这是实际执行PutBucketNotification操作的核心资源。
2. 添加显式依赖关系：让CfnBucketNotification依赖于S3桶的Policy资源，强制AWS先完成桶策略的创建/更新，再执行事件通知配置操作，从根源避免并发冲突。

内容的提问来源于stack exchange，提问作者Joey Yi Zhao