cdk migrate --from-scan fails due to unsupported/unknown resource properties

Hello.

As mentioned in the GitHub issue, you will likely encounter errors with the migrate command until unsupported properties, such as the "RecursiveLoop" property, are supported.
https://github.com/aws/aws-cdk-cli/issues/642

If you absolutely want to manage it with CDK, you might want to try out IaC generators as well.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/generate-IaC.html#generate-template-considerations

The issue you're experiencing with cdk migrate --from-scan failing due to unsupported or unknown resource properties is a known challenge when migrating manually created AWS resources. The scan process detects your existing resources, but the migration can fail when certain properties returned by the AWS APIs aren't directly supported in CloudFormation or CDK constructs.

Here are some approaches to resolve this:

1. Manual Property Cleanup After the scan completes but before synthesis, you may need to manually edit the generated CDK code to remove or modify unsupported properties. Properties like AbacStatus, SecurityPolicy, and RecursiveLoop that you mentioned may be read-only attributes or service-specific metadata that shouldn't be included in the infrastructure-as-code definition.

2. Use Supported Properties Only When defining resources in CDK, focus on the core configuration properties that are officially supported by CloudFormation. For Lambda functions, this includes properties like Code, Handler, Role, and Runtime. For S3 buckets, focus on bucket policies, encryption settings, and lifecycle rules rather than internal service attributes.

3. Incremental Migration Instead of migrating all resources at once, consider migrating resources incrementally. Start with simpler resources (like S3 buckets) and gradually add more complex ones (like API Gateway and Lambda integrations). This allows you to identify and fix property issues one resource at a time.

4. Review Generated Templates Examine the CloudFormation template generated during the synthesis phase. Remove any properties that aren't documented in the official CloudFormation resource specifications for the respective services.

5. Consider Alternative Migration Paths If cdk migrate --from-scan continues to fail, you might need to manually recreate the CDK constructs using the CDK Construct Library, which provides higher-level abstractions with smart defaults and best practices. This approach gives you more control over which properties are included and ensures compatibility with CDK standards.

The root cause is that the scan process captures the complete state of your resources as returned by AWS APIs, which includes internal metadata and read-only properties that aren't meant to be specified in infrastructure definitions. CloudFormation and CDK only support a subset of these properties for resource creation and management.
Sources
interface CodeProperty · AWS CDK
Deploying Lambda functions with AWS CDK - AWS Lambda