aws / aws/aws-cdk

(pipelines): terminationProtection is ignored on stacks deployed from a CDK CodePipeline

Open
#17,871 12 comments 7 reactions 0 assignees View on GitHub
@aws-cdk/pipelines effort/small feature-request p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

The `Stack` property `terminationProtection` is ignored when the `Stack` is deployed from a CDK `CodePipeline`.

If the stack is deployed directly from the CLI (not from the CDK `CodePipeline`) it works.

A repo demonstrating the issue can be found here:
https://github.com/mpvosseller/cdk-pipeline-termination-protection

### Reproduction Steps

1) Fork this repo: https://github.com/mpvosseller/cdk-pipeline-termination-protection
2) Create a plain text secret in `SecretsManager` with your github token
3) Update `githubOwner`, `githubRepo`, and `githubAccessToken` in the file `myapp-pipeline-stack.ts`
4) Run `npm install`
5) Run `npm run cdk deploy`
6) Log into the CloudFormation console
7) Wait for the `MyappPipelineStack` stack to deploy
8) Wait for the CodePipeline to complete and the `Prod-MyappStack` stack to be deployed
9) Observe that the `MyappPipelineStack` stack correctly has termination protection enabled
10) Observe that the `Prod-MyappStack` stack does NOT have termination protection enabled. **This is the bug**. `terminationProtection` was set to true but was not enabled.
11) Run `npm run cdk deploy "MyappPipelineStack/Prod/MyappStack"`
12) Observe that the `Prod-MyappStack` stack now has termination protection enabled.

### What did you expect to happen?

The `Prod-MyappStack` should be deployed with termination protection enabled.

### What actually happened?

The `Prod-MyappStack` was deployed without termination protection enabled.

### CDK CLI Version

2.0.0 (build 4b6ce31)

### Framework Version

2.0.0

### Node.js Version

v14.17.4

### OS

macOS

### Language

Typescript

### Language Version

3.9.10

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the linked reproduction repository and inspect myapp-pipeline-stack.ts after running npm install and npm run cdk deploy. Compare termination protection on the directly deployed pipeline stack with Prod-MyappStack deployed through CodePipeline, then trace the relevant CDK deployment path. Done means the pipeline-deployed Prod-MyappStack has termination protection enabled, matching direct CLI deployment.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.