aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
CFN - [Enhancement] - Tag stacks with their current state (to provide safe action for continuing deletion of a delete-failed stack)
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource name
_No response_
### Description
I'd like to create a console role that can take stacks out of the delete-fail state and doesn't require me to break glass. Rational is that if a stack is already in a bad state and was safely being deleted by my infrastructure-as-code code, clicking continue can't be bad (a reason to want to use this, is if a delete failed because of a limit exceeded exception). Currently, we'd need to allow for `cloudformation:Delete` on Resource '*', which is too dangerous because it can delete production systems. I'd rather be able to fix this with a feature that is more general and powerful: could you tag stacks with their current state, so that I can condition on this in my IAM policy? I'd like to be able to write:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/CFNStatus": "DELETE_FAILED"
}
}
}
]
}
```
Alternative considered to solve the same problem: ask for `cloudformation:ContinueDelete` action similar to `ContinueUpdate`. The downside of this is that I would need to change how I trigger the `Delete` action into triggering a different delete action instead, so it requires more changes. Moreover, it seems that having a CFNStatus tag is more general.
### Other Details
_No response_
Contributor guide
Research direction
No implementation files or tests are named in this roadmap issue. Start by reviewing CloudFormation DeleteStack behavior for DELETE_FAILED stacks and IAM resource-tag conditions; done means safely enabling the requested condition-based action without permitting unrestricted production deletion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100