Add stack policy document support to `aws cloudformation deploy`
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the feature
Add a `--stack-policy ` parameter to the `aws cloudformation deploy` command-line arguments so a Stack Policy Document can be applied idempotently alongside the template, in order for user to benefit from the protections that a Policy Document gives.
### Use Case
I'd like to perform gitops with cloudformation templates and optional stack policy json files side-by-side. This would prevent accidental resource updates, replacement, deletions etc if an appropriate policy document exists. If the intention really is to affect the protected resource, then the stack policy document would also be updated (making an accident less likely, as modifying the policy document strongly implies intent).
### Proposed Solution
`aws cloudformation deploy` helps simplify scripting, esp in automated CI/CD pipelines, replacing the need to do all the steps (testing whether a stack already exists, checking the changeset isn't empty, etc)
[Stack Policies](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html) help with safety, so that some resources can be protected from accidental updates that might, for example, replace a production database.
It would be great if `aws cloudformation deploy` could add the capability to work with Stack Policies.
Ideal behaviour would be:
* If the stack doesn't exists, and a `--stack-policy ` is supplied, then it invoke `aws cloudformation create-stack` passing `--stack-policy-body` with the contents of the policy file
* If the stack already exists, and a `--stack-policy ` is supplied, then it first calls `aws cloudformation set-stack-policy` with the contents of the policy file, then does it normal change-set creation, and `aws cloudformation update-stack` if the changeset in non-empty.
### Other Information
_No response_
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CLI version used
2.08
### Environment details (OS name and version, etc.)
macOS 12.6
Contributor guide
Assessment
This issue has not been assessed yet.