(cli): add `--execute-only` or `--skip-create-change-set` flag

In order to better support deployments from a pipeline (not code pipeline), it would be ideal if the CLI could execute change sets without creating them.

Use Case

Support for a pipeline that has 3 steps:

• Step 1: Create change set(s)
• Step 2: Human review and approval of change set(s)
• Step 3: Deploy change set(s)

Creating change sets without executing them is already supported with --no-execute. There’s WIP to print change set details in https://github.com/aws/aws-cdk/pull/15494 to make the human review step easier.

The only way to implement step 3 currently is to use an external tool/script to apply the change set.

Proposed Solution

Add an --execute-only flag to skip change set creation.

The process would be:

Step 1: cdk deploy --no-execute --change-set-name ci-build-$n. Step 2: Human review and approval of the change sets created in Step 1. Step 3: cdk deploy --execute-only --change-set-name ci-build-$n.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[stevehodgkiss]

I understand and I sympathize, but CDK is not the right level of abstraction to implement this, and I don’t want to be maintaining code for various odds-and-ends use cases that would be better served by other tooling. It will only slow CDK down in the future, and we have to balance the long-term health of the product with the use cases we unlock.

These are not odds and ends use cases. A cdk plan with a cdk deploy in CI is just asking for danger and if the plan won’t be the same in the deploy step (it’s not approving anything except good luck friend, but with terraform the apply has an outfile file and will be what you will execute). If you want to build a consistent tool that can be used like terraform then this is an oversight.

I think it’s important to separate CDK library development from CDK API “abstractions”. CDK is great, I really enjoy working with it, but a JS API to instruct deployments based on the metadata output could enable so many more things. That’s the bigger picture I’m hoping for.

This is not our core competency either (the framework is), it’s just something we incidentally have to do to make the rest of CDK be useful at all.

This is exactly my point. The framework around this, CDK CLI, or the CDK API, is what would multiply the value of CDK itself as it is now, for many companies.

[rix0rrr]

I understand and I sympathize, but CDK is not the right level of abstraction to implement this, and I don’t want to be maintaining code for various odds-and-ends use cases that would be better served by other tooling. It will only slow CDK down in the future, and we have to balance the long-term health of the product with the use cases we unlock.

Yes, CDK has a “start-CFN-deployment-and-wait-for-it” feature. That doesn’t mean it should be generically reusable for any CloudFormation change set deployment.

Preferably there should be an external tool that does exactly that, nothing more and nothing less. I know it’s frustrating, but that doesn’t mean CDK should become that tool, just because we could. In fact, I’d love for some tool to exist and CDK to reuse it and drop that code from our code base. This is not our core competency either (the framework is), it’s just something we incidentally have to do to make the rest of CDK be useful at all.