(pipelines): terminationProtection is ignored on stacks deployed from a CDK CodePipeline
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### What is the problem?
The `Stack` property `terminationProtection` is ignored when the `Stack` is deployed from a CDK `CodePipeline`.
If the stack is deployed directly from the CLI (not from the CDK `CodePipeline`) it works.
A repo demonstrating the issue can be found here:
https://github.com/mpvosseller/cdk-pipeline-termination-protection
### Reproduction Steps
1) Fork this repo: https://github.com/mpvosseller/cdk-pipeline-termination-protection
2) Create a plain text secret in `SecretsManager` with your github token
3) Update `githubOwner`, `githubRepo`, and `githubAccessToken` in the file `myapp-pipeline-stack.ts`
4) Run `npm install`
5) Run `npm run cdk deploy`
6) Log into the CloudFormation console
7) Wait for the `MyappPipelineStack` stack to deploy
8) Wait for the CodePipeline to complete and the `Prod-MyappStack` stack to be deployed
9) Observe that the `MyappPipelineStack` stack correctly has termination protection enabled
10) Observe that the `Prod-MyappStack` stack does NOT have termination protection enabled. **This is the bug**. `terminationProtection` was set to true but was not enabled.
11) Run `npm run cdk deploy "MyappPipelineStack/Prod/MyappStack"`
12) Observe that the `Prod-MyappStack` stack now has termination protection enabled.
### What did you expect to happen?
The `Prod-MyappStack` should be deployed with termination protection enabled.
### What actually happened?
The `Prod-MyappStack` was deployed without termination protection enabled.
### CDK CLI Version
2.0.0 (build 4b6ce31)
### Framework Version
2.0.0
### Node.js Version
v14.17.4
### OS
macOS
### Language
Typescript
### Language Version
3.9.10
### Other information
_No response_
Contributor guide
Research direction
Start with the linked reproduction repository and inspect myapp-pipeline-stack.ts after running npm install and npm run cdk deploy. Compare termination protection on the directly deployed pipeline stack with Prod-MyappStack deployed through CodePipeline, then trace the relevant CDK deployment path. Done means the pipeline-deployed Prod-MyappStack has termination protection enabled, matching direct CLI deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100