aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::RDS::DBInstance - Validate invalid DeletionPolicy for DB instance resource
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::RDS::DBInstance
### Resource name
_No response_
### Description
According to the document [1], the `AWS::RDS::DBInstance` allows you to have DeletionPolicy and decide how to preserve DB instance. However, CloudFormation did not validate the `DeletionPolicy` when I am deploying the stack by using Amazon RDS DB instance (not Aurora DB cluster) so I expected it works. Once I updated the DB instance resource with CloudFormation (e.g. rename the `DBName` property to trigger replace), not surprisingly, no snapshot for this DB instance will be created.
> For DB instances that are part of an Aurora DB cluster, you can set a deletion policy for your DB instance to control how AWS CloudFormation handles the DB instance when the stack is deleted. For Amazon RDS DB instances, you can choose to `retain` the DB instance, to delete the DB instance, or to create a snapshot of the DB instance.
I think the document [1] wasn't very clear to highlight this issue and it can be ignored as it wasn't very straightforward. Because when I was using the property, I will expect CloudFormation should help me to build a snapshot before deletion. Most importantly, **CloudFormation also did not validate the property or have any warning**. It causes the production impact because I will lose my database data after doing stack update.
[Sample template]
```
Resources:
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName: 'mydb'
AllocatedStorage: 50
StorageType: gp2
DBInstanceClass: 'db.m5.large'
Engine: postgres
EngineVersion: "10.18"
Port: '5432'
MasterUsername: DBUsername
MasterUserPassword: DBPassword
MultiAZ: 'false'
PubliclyAccessible: false
DeletionPolicy: Snapshot
```
[Stack event]

[1] AWS::RDS::DBInstance - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html
### Enhancement request
A simple step is to enhance the documentation to avoid this error, but I do think it would be great to validate the property to prevent DB resource will be deleted without any notice.
Contributor guide
Research direction
Start with the AWS::RDS::DBInstance documentation linked in the issue and reproduce the sample template's stack update, including the DBName rename. Compare the documented DeletionPolicy behavior with the observed result. Done means the invalid policy is validated or clearly warned about, and the documentation explains the limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100