aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::SNS::Topic - Retain topics with unmanaged subscriptions

Open
#1,388 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SNS::Topic

### Resource name

_No response_

### Description

Add DeletionPolicy attribute (or equivalent) to AWS::SNS::Topic.

Currently, when a Topic is managed by CloudFormation and then deleted by CloudFormation, all subscriptions are deleted as well, even if they are not managed by CloudFormation or managed by another AWS account.

By adding DeletionPolicy attribute (or equivalent), we could allow the user to define a "retain" policy that would ensure that deleting an AWS::SNS::Topic would fail if it still contains a subscription.

### Other Details

This ask comes from an outage our team suffered due to cross-account subscription. Account A owned the topic, account B owned the subscription (both managed by CloudFormation via CDK). Account A replaced the topic which deleted the subscription managed by account B. However, further CloudFormation deployments from account B did not re-create the subscription because it had been deleted by account A.
A "retain" policy would have prevented to delete the topic to begin with, forcing the team owning the topic to sync with the team owning the subscriptions.

Steps to reproduce:
1. Create Topic in AWS account A using CloudFormation on AWS account A.
1. Create a subscription on the topic created previously using CloudFormation on AWS account B.
1. Remove the Topic from CloudFormation in AWS account A, which will delete the Topic and its subscriptions.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the AWS::SNS::Topic lifecycle in CloudFormation and the existing DeletionPolicy behavior. Reproduce the cross-account scenario described in the issue, then verify that a retain policy prevents topic deletion while subscriptions remain and preserves the subscription owned by another account.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.