Multiple warnings with aws-cdk-lib 2.224.0

[aramir]

Describe the bug

After updating aws-cdk-lib from 2.222.0 to 2.224.0 started getting multiple warnings during trmplate build (e.g.: running cdk diff or cdk deploy for all l,abda functions registered via NodejsFunction with warning message "ValidationError: The result of fromAwsManagedPolicyName can not be used in this API":

[Warning at /xxx/yyy/PreSignUpFn/ServiceRole] Failed to add construct metadata for node [ServiceRole]. Reason: ValidationError: The result of fromAwsManagedPolicyName can not be used in this API [ack: @aws-cdk/core:addConstructMetadataFailed]
[Warning at /xxx/yyy/PostConfirmationFn/ServiceRole] Failed to add construct metadata for node [ServiceRole]. Reason: ValidationError: The result of fromAwsManagedPolicyName can not be used in this API [ack: @aws-cdk/core:addConstructMetadataFailed]     
...

the function registration itself is very basic/standard:

const preSignUpFn = new NodejsFunction(this, "PreSignUpFn", {
	description: "Cognito preSignUp Trigger Function",
	entry: path.join(__dirname, "../src/functions/cognito/preSignUp.ts"),
	runtime: Runtime.NODEJS_22_X,
	handler: "handler",
	bundling: {
		bundleAwsSDK: true
	}
});

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

aws-cdk-lib 2.222.0

Expected Behavior

No warnings shown

Current Behavior

Warnings "ValidationError: The result of fromAwsManagedPolicyName can not be used in this API" shown for each lambda function

Reproduction Steps

Create lambda function using NodejsFunction:

const preSignUpFn = new NodejsFunction(this, "PreSignUpFn", {
	description: "Cognito preSignUp Trigger Function",
	entry: path.join(__dirname, "../src/functions/cognito/preSignUp.ts"),
	runtime: Runtime.NODEJS_22_X,
	handler: "handler",
	bundling: {
		bundleAwsSDK: true
	}
});

source code doesn't matter, empty handler function could be used

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.224.0

AWS CDK CLI version

2.1031.2

Node.js Version

22.17.0

OS

Windows 10

Language

TypeScript

Language Version

5.6.3

Other information

• No response

[cloudopolis]

I'm seeing the same.

[Tietew]

Same here.
The minimum reproducible code seems to be:

const role = new iam.Role(this, 'Role', {
  assumedBy: new iam.AccountRootPrincipal(),
  managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')],
});

[Warning at /TestStack/Role] Failed to add construct metadata for node [Role]. Reason: ValidationError: The result of fromAwsManagedPolicyName can not be used in this API [ack: @aws-cdk/core:addConstructMetadataFailed]

[pahud]

Looking into this issue now. If you have the same issue, please click 👍 to let us know.

[pahud]

Hi @aramir
cc @cloudopolis @Tietew

Thank you for reporting this issue. To help us investigate further, could you please check if you have the @aws-cdk/core:enableAdditionalMetadataCollection feature flag explicitly enabled in your cdk.json file?

We've investigated the upgrade path from v2.178.0 to v2.224.0 and confirmed that this feature flag is not automatically enabled during upgrades. The flag only appears in projects that were:

1. Created with cdk init after v2.178.0 (where it's included in the template), or
2. Had the flag manually added to cdk.json

Our testing shows:
• ✅ Upgrading from v2.178.0 → v2.224.0 without the flag: No warnings
• ⚠️ With the flag explicitly enabled: The warning appears

The warning itself appears to be a bug in the metadata collection code when dealing with imported resources like ManagedPolicy.fromAwsManagedPolicyName(). However, understanding whether you have this flag
enabled will help us determine if this is affecting existing projects or only new ones.

[pahud]

From my investigation, the bug seems to be from @aws-cdk/core:enableAdditionalMetadataCollection and the team is aware of this.

Let's discuss the following 3 scenarios:

Scenario 1: Upgrading from pre-2.178.0 → 2.224.0

Will see warnings? ❌ NO

Why? The feature flag @aws-cdk/core:enableAdditionalMetadataCollection defaults to OFF for existing projects. The flag is only ON for new projects created with cdk init after v2.178.0.

Existing project (created before 2.178.0)
  ↓
Upgrade to 2.224.0
  ↓
Feature flag = OFF (default for existing projects)
  ↓
No metadata collection = No warnings

Scenario 2: Explicitly turned ON the feature flag

Will see warnings? ✅ YES (if using Lambda functions or other constructs with imported managed policies)

How to suppress?

Option 1: Disable the feature flag

{
  "context": {
    "@aws-cdk/core:enableAdditionalMetadataCollection": false
  }
}

Option 2: Acknowledge the warning in your Stack

export class MyStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Suppress the metadata collection warning for this stack
    cdk.Annotations.of(this).acknowledgeWarning(
      '@aws-cdk/core:addConstructMetadataFailed',
      'Known issue with imported managed policies'
    );

    // ... rest of your stack
  }
}

Note: The context flag "@aws-cdk/core:addConstructMetadataFailed": true does NOT suppress the warning. It only provides an acknowledgment ID in the warning message.

Scenario 3: Fresh cdk init after v2.178.0

Will see warnings? ✅ YES (if using Lambda functions or other constructs with imported managed policies)
Why? New projects have the feature flag ON by default. Use the same options as Scenario 2 above to surpass.