aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::RDS::DBInstance - Validate invalid DeletionPolicy for DB instance resource

Open
#1,180 3 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::RDS::DBInstance

### Resource name

_No response_

### Description

According to the document [1], the `AWS::RDS::DBInstance` allows you to have DeletionPolicy and decide how to preserve DB instance. However, CloudFormation did not validate the `DeletionPolicy` when I am deploying the stack by using Amazon RDS DB instance (not Aurora DB cluster) so I expected it works. Once I updated the DB instance resource with CloudFormation (e.g. rename the `DBName` property to trigger replace), not surprisingly, no snapshot for this DB instance will be created.

> For DB instances that are part of an Aurora DB cluster, you can set a deletion policy for your DB instance to control how AWS CloudFormation handles the DB instance when the stack is deleted. For Amazon RDS DB instances, you can choose to `retain` the DB instance, to delete the DB instance, or to create a snapshot of the DB instance.

I think the document [1] wasn't very clear to highlight this issue and it can be ignored as it wasn't very straightforward. Because when I was using the property, I will expect CloudFormation should help me to build a snapshot before deletion. Most importantly, **CloudFormation also did not validate the property or have any warning**. It causes the production impact because I will lose my database data after doing stack update.

[Sample template]
```
Resources:
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName: 'mydb'
AllocatedStorage: 50
StorageType: gp2
DBInstanceClass: 'db.m5.large'
Engine: postgres
EngineVersion: "10.18"
Port: '5432'
MasterUsername: DBUsername
MasterUserPassword: DBPassword
MultiAZ: 'false'
PubliclyAccessible: false
DeletionPolicy: Snapshot
```

[Stack event]

![image](https://user-images.githubusercontent.com/1008379/169853800-01729ce2-a799-43c7-8960-820cb96bf97e.png)

[1] AWS::RDS::DBInstance - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html

### Enhancement request

A simple step is to enhance the documentation to avoid this error, but I do think it would be great to validate the property to prevent DB resource will be deleted without any notice.

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::RDS::DBInstance documentation linked in the issue and reproduce the sample template's stack update, including the DBName rename. Compare the documented DeletionPolicy behavior with the observed result. Done means the invalid policy is validated or clearly warned about, and the documentation explains the limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.