fix: raise on ambiguous resource ID collision across sibling nested stacks

samcli/commands/local/cli_common/user_exceptions.py

@@ -47,6 +47,12 @@ class ResourceNotFound(UserException):
     """
 
 
+class AmbiguousResourceIdentifier(UserException):
+    """
+    A bare resource logical ID (without a stack path) matched resources in more than one stack
+    """
+
+
 class InvalidLayerVersionArn(UserException):
     """
     The LayerVersion Arn given in the template is Invalid

samcli/lib/providers/provider.py

@@ -11,9 +11,10 @@
 from dataclasses import dataclass
 from enum import Enum
 from pathlib import Path
-from typing import Any, Dict, Iterator, List, NamedTuple, Optional, Set, Union, cast
+from typing import Any, Dict, Iterator, List, NamedTuple, Optional, Set, Tuple, Union, cast
 
 from samcli.commands.local.cli_common.user_exceptions import (
+    AmbiguousResourceIdentifier,
     InvalidFunctionPropertyType,
     InvalidLayerVersionArn,
     UnsupportedIntrinsic,
@@ -883,8 +884,19 @@ def get_resource_by_id(
     -------
     Dict
         Resource dict
+
+    Raises
+    ------
+    AmbiguousResourceIdentifier
+        If a bare logical ID (no stack path given) matches resources in more than one *nested*
+        stack, with no match in the root stack to prefer. The root stack, if it has a match, always
+        takes priority (this is relied upon by existing behavior); but silently picking the first
+        nested-stack match in stack-list order when there is no root match - and more than one
+        nested stack collides - could operate on the wrong physical resource (e.g.
+        `sam sync --resource-id`), so that specific case is now a clear, actionable error instead.
     """
     search_all_stacks = not identifier.stack_path and not explicit_nested
+    matches: List[Tuple[Stack, Dict[str, Any]]] = []
     for stack in stacks:
         if stack.stack_path == identifier.stack_path or search_all_stacks:
             found_resource = None
@@ -897,8 +909,22 @@ def get_resource_by_id(
                     break
 
             if found_resource:
-                return cast(Dict[str, Any], found_resource)
-    return None
+                if not stack.stack_path:
+                    # The root stack always takes priority over nested stacks.
+                    return cast(Dict[str, Any], found_resource)
+                matches.append((stack, found_resource))
+                if not search_all_stacks:
+                    break
+
+    if len(matches) > 1:
+        colliding_paths = [get_full_path(stack.stack_path, identifier.resource_iac_id) for stack, _ in matches]
+        raise AmbiguousResourceIdentifier(
+            f"Resource ID '{identifier.resource_iac_id}' is ambiguous: it matches resources in more than one "
+            f"nested stack ({', '.join(colliding_paths)}). Qualify it with the full stack path, "
+            f"e.g. '{colliding_paths[0]}'."
+        )
+
+    return cast(Dict[str, Any], matches[0][1]) if matches else None
 
 
 def get_resource_full_path_by_id(stacks: List[Stack], identifier: ResourceIdentifier) -> Optional[str]:

tests/unit/commands/local/lib/test_provider.py

@@ -21,6 +21,7 @@
     FunctionBuildInfo,
 )
 from samcli.commands.local.cli_common.user_exceptions import (
+    AmbiguousResourceIdentifier,
     InvalidLayerVersionArn,
     UnsupportedIntrinsic,
     InvalidFunctionPropertyType,
@@ -652,6 +653,55 @@ def test_get_resource_by_id_not_found(
         self.assertEqual(result, None)
 
 
+class TestGetResourceByIDAmbiguousNestedStacks(TestCase):
+    """
+    Regression tests: a bare (unqualified) resource ID that matches resources in more than one
+    *nested* stack, with no root-stack resource to prefer, used to silently return whichever
+    stack happened to come first in the input list - which could point sync/invoke/logs operations
+    at the wrong deployed physical resource. This must now raise AmbiguousResourceIdentifier instead.
+    """
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.root_stack = MagicMock()
+        self.root_stack.stack_path = ""
+        self.root_stack.resources = {}
+
+        self.nested_stack_a = MagicMock()
+        self.nested_stack_a.stack_path = "NestedStackA"
+        self.nested_stack_a.resources = {"Function1": {"Properties": "BodyA"}}
+
+        self.nested_stack_b = MagicMock()
+        self.nested_stack_b.stack_path = "NestedStackB"
+        self.nested_stack_b.resources = {"Function1": {"Properties": "BodyB"}}
+
+    def test_raises_when_two_sibling_nested_stacks_collide(self):
+        resource_identifier = MagicMock()
+        resource_identifier.stack_path = ""
+        resource_identifier.resource_iac_id = "Function1"
+
+        with self.assertRaises(AmbiguousResourceIdentifier):
+            get_resource_by_id([self.root_stack, self.nested_stack_a, self.nested_stack_b], resource_identifier, False)
+
+    def test_does_not_raise_when_only_one_nested_stack_matches(self):
+        resource_identifier = MagicMock()
+        resource_identifier.stack_path = ""
+        resource_identifier.resource_iac_id = "Function1"
+
+        result = get_resource_by_id([self.root_stack, self.nested_stack_a], resource_identifier, False)
+        self.assertEqual(result, self.nested_stack_a.resources["Function1"])
+
+    def test_does_not_raise_when_explicitly_qualified_with_stack_path(self):
+        resource_identifier = MagicMock()
+        resource_identifier.stack_path = "NestedStackA"
+        resource_identifier.resource_iac_id = "Function1"
+
+        result = get_resource_by_id(
+            [self.root_stack, self.nested_stack_a, self.nested_stack_b], resource_identifier, False
+        )
+        self.assertEqual(result, self.nested_stack_a.resources["Function1"])
+
+
 class TestGetResourceIDsByType(TestCase):
     def setUp(self) -> None:
         super().setUp()