aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Improvement of CloudFormation deletion workflow of AWS::RDS::DBCluster

Open
#1,507 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::RDS::DBCluster

### Resource name

_No response_

### Description

Hello team,

To understand the context of this enhancement request, please consider the following:

- RDS Cluster resource being managed from CloudFormation where a Secrets Manager's secret is being used via dynamic references in properties like username and password.
- The secret being used is deleted now.
- Now this RDS cluster is attempted for deletion in the CloudFormation Stack, which is throwing "Secrets Manager can't find the specified secret."

Having said that one workaround is to counter this error by re-creating the secret with same name, this can be improved if CloudFormation could make a describe call before it actually initiates a delete on the cluster. If it can see that the cluster is non existing (cannot describe it), it can mark the resource as DELETE_COMPLETE, which is the desired state for customers when they initiate a delete.

Its understandable that the secret value is not stored anywhere so resolving the secret during runtime is expected, but especially during deletes, if the above can be implemented, it surely helps customers be able to clean up their RDS resources in such scenarios more swiftly.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue names AWS::RDS::DBCluster and the CloudFormation deletion workflow, but no files, tests, or entry points. Start by reviewing how deletion handles dynamic Secrets Manager references and how a missing cluster is detected. Done means deletion can reach DELETE_COMPLETE when the cluster cannot be described because its referenced secret was deleted.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.