aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::SNS::Topic - Retain topics with unmanaged subscriptions
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SNS::Topic
### Resource name
_No response_
### Description
Add DeletionPolicy attribute (or equivalent) to AWS::SNS::Topic.
Currently, when a Topic is managed by CloudFormation and then deleted by CloudFormation, all subscriptions are deleted as well, even if they are not managed by CloudFormation or managed by another AWS account.
By adding DeletionPolicy attribute (or equivalent), we could allow the user to define a "retain" policy that would ensure that deleting an AWS::SNS::Topic would fail if it still contains a subscription.
### Other Details
This ask comes from an outage our team suffered due to cross-account subscription. Account A owned the topic, account B owned the subscription (both managed by CloudFormation via CDK). Account A replaced the topic which deleted the subscription managed by account B. However, further CloudFormation deployments from account B did not re-create the subscription because it had been deleted by account A.
A "retain" policy would have prevented to delete the topic to begin with, forcing the team owning the topic to sync with the team owning the subscriptions.
Steps to reproduce:
1. Create Topic in AWS account A using CloudFormation on AWS account A.
1. Create a subscription on the topic created previously using CloudFormation on AWS account B.
1. Remove the Topic from CloudFormation in AWS account A, which will delete the Topic and its subscriptions.
Contributor guide
Research direction
Start by reviewing the AWS::SNS::Topic lifecycle in CloudFormation and the existing DeletionPolicy behavior. Reproduce the cross-account scenario described in the issue, then verify that a retain policy prevents topic deletion while subscriptions remain and preserves the subscription owned by another account.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100