aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

CFN - [Enhancement] - Tag stacks with their current state (to provide safe action for continuing deletion of a delete-failed stack)

Open
#2,344 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource name

_No response_

### Description

I'd like to create a console role that can take stacks out of the delete-fail state and doesn't require me to break glass. Rational is that if a stack is already in a bad state and was safely being deleted by my infrastructure-as-code code, clicking continue can't be bad (a reason to want to use this, is if a delete failed because of a limit exceeded exception). Currently, we'd need to allow for `cloudformation:Delete` on Resource '*', which is too dangerous because it can delete production systems. I'd rather be able to fix this with a feature that is more general and powerful: could you tag stacks with their current state, so that I can condition on this in my IAM policy? I'd like to be able to write:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/CFNStatus": "DELETE_FAILED"
}
}
}
]
}
```

Alternative considered to solve the same problem: ask for `cloudformation:ContinueDelete` action similar to `ContinueUpdate`. The downside of this is that I would need to change how I trigger the `Delete` action into triggering a different delete action instead, so it requires more changes. Moreover, it seems that having a CFNStatus tag is more general.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

No implementation files or tests are named in this roadmap issue. Start by reviewing CloudFormation DeleteStack behavior for DELETE_FAILED stacks and IAM resource-tag conditions; done means safely enabling the requested condition-based action without permitting unrestricted production deletion.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.