aws-cdk: (aws-elasticache): Update is failing in stacks containing CfnUserGroup after changing Tags

When using elasticache CfnUserGroup in a stack, the fresh deployment is successful but after changing the Tags in the stack props, the CDK deployment is failing while trying to update the UserGroup. There are no changes made to the UserGroup resource directly.

Found another to this: https://github.com/aws/aws-cdk/issues/15378. It was closed because it was not re-producible.

Reproduction Steps

Consider the stack

import * as cdk from "@aws-cdk/core";
import * as elasticache from "@aws-cdk/aws-elasticache";

export class RedisStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props: cdk.StackProps) {
        super(scope, id, props);

        const redisDefaultUser = new elasticache.CfnUser(
            this,
            "RedisDefaultUser",
            {
                engine: "redis",
                userId: `redis-default-user`,
                userName: "default",
                passwords: [`dontusethiswaytosetpassword`],
                accessString: "on ~* +@all"
            }
        );

        const redisUserGroup = new elasticache.CfnUserGroup(
            this,
            "RedisUserGroup",
            {
                engine: "redis",
                userGroupId: `redis-user-group-bug`,
                userIds: [redisDefaultUser.ref]
            }
        );
        redisUserGroup.addDependsOn(redisDefaultUser);
    }
}

The stack is created as

import { App } from "@aws-cdk/core";

import { RedisStack } from "./redisStack";

const startCdkDeploy = (): void => {
    //Create the stack
    const app = new App();
    new RedisStack(app, "RedisStack", {
        stackName: "RedisTestStack",
        description: "Redis test stack",
        tags: {
            project: "redis",
            owner: "owner-1"
        }
    });
    app.synth();
};

startCdkDeploy();

The fresh deployment of the stack is successful and upgrade without any changes will also work fine. Then update the stack tag in the constructer to owner-2

tags: {
            project: "redis",
            owner: "owner-2"
        }

Update the stack using cdk deploy

What did you expect to happen?

The stack should get updated without errors and Tags should be updated.

What actually happened?

The stack update is erroring out with the following error.

7:05:32 AM | UPDATE_FAILED        | AWS::ElastiCache::UserGroup | RedisStack/RedisUserGroup
Resource handler returned message: "Please specify the list of user identifiers to be added or removed. (Service: ElastiCache, Status Code: 4
00, Request ID: 5735c315-84ed-4833-99ba-735b0460d46f, Extended Request ID: null)" (RequestToken: da75398a-3185-86af-ccc0-f2e4bef42778, Handle
rErrorCode: GeneralServiceException)

Environment

• **CDK CLI Version :1.116.0 (build d04661d)
• **Framework Version:1.117.0
• **Node.js Version:v12.22.4
• **OS :CentOS Linux release 7.8.2003
• **Language (Version):TypeScript(3.9.9)

Other

---

This is 🐛 Bug Report