CloudFormation Early Validation Hook Blocking Neptune Analytics Deployment

Question

(I used AI to help format)
## Problem Summary

I'm encountering a deployment failure when attempting to create an Amazon Neptune Analytics graph using AWS CDK (TypeScript) and CloudFormation. The deployment fails during the change set creation phase with an Early Validation hook error, despite all resources being correctly configured and available in the region.

## Error Message

```
❌  DigitalTwin-Neptune-dev failed: ToolkitError: Failed to create ChangeSet cdk-deploy-change-set on DigitalTwin-Neptune-dev: FAILED, The following hook(s)/validation failed: [AWS::EarlyValidation::ResourceExistenceCheck]. To troubleshoot Early Validation errors, use the DescribeEvents API for detailed failure information.
```

## Environment Details

- **Region**: us-west-2
- **CDK Version**: 2.100+
- **Resource Type**: `AWS::NeptuneGraph::Graph`
- **Deployment Method**: AWS CDK with TypeScript
- **CloudFormation Feature**: Early Validation (introduced November 2024)

## What I've Verified

1. ✅ **Neptune Analytics is available in us-west-2** - Confirmed via AWS regional availability API
2. ✅ **CloudFormation resource type exists** - `AWS::NeptuneGraph::Graph` is documented and supported
3. ✅ **CDK code is correct** - All unit tests pass (118/118), template synthesizes successfully
4. ✅ **All referenced resources exist** - VPC, subnets, security groups are all properly created
5. ✅ **Graph name follows naming rules** - Using lowercase with hyphens: `digitaltwin-neptune-dev-network-topology`

## CDK Code Structure

```typescript
import * as cdk from 'aws-cdk-lib';
import * as neptunegraph from 'aws-cdk-lib/aws-neptunegraph';

export class NeptuneStack extends cdk.Stack {
  public readonly graph: neptunegraph.CfnGraph;

constructor(scope: Construct, id: string, props: NeptuneStackProps) {
    super(scope, id, props);

// Create Neptune Analytics Graph
    this.graph = new neptunegraph.CfnGraph(this, 'NetworkTopologyGraph', {
      graphName: 'digitaltwin-neptune-dev-network-topology',
      provisionedMemory: props.provisionedMemory || 16,
      publicConnectivity: false,
      replicaCount: props.replicaCount || 0,
      deletionProtection: props.deletionProtection || false,
      vectorSearchConfiguration: {
        vectorSearchDimension: 1536,
      },
    });

// Note: PrivateGraphEndpoint creation also fails with same error
  }
}
```

## Attempted Workarounds

All of the following still result in the same Early Validation error:

1. ❌ **Fixed graph name to strict lowercase format** - No change
2. ❌ **Removed PrivateGraphEndpoint resource** - Still fails on Graph creation
3. ❌ **Added explicit resource dependencies** - No effect
4. ❌ **Direct AWS CLI deployment** - Same validation error
5. ❌ **CDK `--method=direct` flag** - Still hits validation

## Current Workaround

I've temporarily disabled the Neptune Analytics and dependent TwinMaker stacks in my CDK app to allow deployment of other infrastructure (VPC, S3, IAM, CloudTrail). The synthesized CloudFormation template is saved for future deployment once this issue is resolved.

## Questions for the Community

1. **Has anyone successfully deployed Neptune Analytics via CloudFormation/CDK recently?** If so, what region and configuration did you use?

2. **Is this a known issue with the Early Validation hook and Neptune Analytics?** I couldn't find any public reports or GitHub issues about this specific problem.

3. **Are there any undocumented requirements or prerequisites** for Neptune Analytics CloudFormation deployments that might not be in the official documentation?

4. **Has anyone found a working workaround** beyond deploying via AWS Console or CLI?

## Additional Context

- The CloudFormation Early Validation feature has been in production since November 2024
- Neptune Analytics CloudFormation support is officially documented
- I found zero public examples of Neptune Analytics deployed via CDK in aws-samples, awslabs, or community repositories
- All other AWS resources in my stack (VPC, S3, IAM, CloudTrail) deploy successfully

## What I'm Looking For

- Confirmation from others who have experienced this issue
- Any successful Neptune Analytics + CDK deployment examples
- Guidance on whether this should be reported to AWS Support
- Alternative approaches or configurations that might work

## References

- [CloudFormation Early Validation Documentation](https://aws.amazon.com/blogs/devops/accelerate-infrastructure-development-with-cloudformation-pre-deployment-validation-and-simplified-troubleshooting/)
- [Neptune Analytics CloudFormation Resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-neptunegraph-graph.html)
- [Neptune Analytics User Guide](https://docs.aws.amazon.com/neptune-analytics/latest/userguide/what-is-neptune-analytics.html)

re:Post Agent · Answer

The issue you're experiencing with Neptune Analytics deployment appears to be related to CloudFormation Lambda Hooks performing early validation checks. These hooks are designed to evaluate resources before stack operations are executed, and in your case, the `AWS::EarlyValidation::ResourceExistenceCheck` hook is failing.

CloudFormation Lambda Hooks can be configured with different failure modes:

1. **FAIL**: This prevents the action from proceeding and is used for enforcing strict compliance or security policies.
2. **WARN**: This issues warnings but allows actions to continue, useful for non-critical validations.

In your case, the hook is likely configured with the FAIL mode, which is blocking your deployment.

There are a few potential causes and solutions to explore:

**Potential causes:**
1. The Early Validation hook might be checking for prerequisites that aren't met for Neptune Analytics in your account or region.
2. There could be a mismatch between the CloudFormation resource type definition and the actual service API.
3. The hook might be enforcing policies specific to your organization that restrict Neptune Analytics deployments.

**Suggested approaches:**

1. **Check CloudWatch Logs**: Look for logs from the Lambda Hook execution to understand the specific validation failure. The hook invocation results should provide detailed information about why the validation failed.

2. **Use the AWS CLI to get hook results**: You can retrieve detailed information about the hook invocation using:
```
aws cloudformation get-hook-result --hook-result-id  --region us-west-2
```
The hook result ID should be available in the CloudFormation events.

3. **Examine CloudFormation Events**: Use the DescribeEvents API as suggested in the error message to get more detailed failure information.

4. **Consider Neptune Analytics operational procedures**: Ensure you're following best practices for Neptune Analytics deployment, such as proper sizing and configuration.

5. **Contact AWS Support**: Since this appears to be a specific interaction between CloudFormation Early Validation and Neptune Analytics, and you've already tried multiple workarounds, AWS Support might be able to provide specific guidance or identify if there's a known issue.

For your immediate needs, you might need to continue with your current workaround of deploying other infrastructure components while this issue is being resolved. If you need to deploy Neptune Analytics urgently, consider using the AWS Console or direct API calls as an alternative approach until the CloudFormation deployment issue is resolved.  
**Sources**  
[Validate Your Lambda Runtime with CloudFormation Lambda Hooks | AWS DevOps & Developer Productivity Blog](https://aws.amazon.com/blogs/devops/validate-your-lambda-runtime-with-cloudformation-lambda-hooks/)  
[View invocation results for CloudFormation Hooks - CloudFormation](https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/hooks-view-invocations.html)  
[class CfnLambdaHook (construct) · AWS CDK](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudformation.CfnLambdaHook.html)  
[Operational excellence pillar - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/neptune-analytics-well-architected-framework/operational-excellence-pillar.html)

Taz · Answer

Hey,

Hope you're keeping well.

The `AWS::EarlyValidation::ResourceExistenceCheck` hook runs before stack creation to verify that referenced resources and service endpoints are available. For new resource types like `AWS::NeptuneGraph::Graph`, this can fail if the service’s CloudFormation integration isn’t fully rolled out in your region or if the API endpoint isn’t yet enabled in your account. I’d recommend running `aws cloudformation describe-stack-events --stack-name ` to see the exact validation failure, and confirm via `aws neptune-graph list-graphs --region us-west-2` that the service responds.

Thanks and regards,  
Taz

Taz · Answer

Hey,

Hope you're keeping well.

The `AWS::EarlyValidation::ResourceExistenceCheck` hook runs before stack creation and will fail if CloudFormation detects the resource type isn’t fully deployable in your account or region. For new services like Neptune Analytics, this can happen if the service’s CloudFormation integration isn’t yet enabled in that region for your account. Use `aws cloudformation describe-stack-events --stack-name ` to get the exact failure reason, and verify the `AWS::NeptuneGraph::Graph` type is listed in `aws cloudformation list-types --visibility PUBLIC --region us-west-2`.

Thanks and regards,  
Taz

CloudFormation Early Validation Hook Blocking Neptune Analytics Deployment

Problem Summary

Error Message

Environment Details

What I've Verified

CDK Code Structure

Attempted Workarounds

Current Workaround

Questions for the Community

Additional Context

What I'm Looking For

References

Add your answer

Relevant content