Enable termination protection of a stack

Hello,

in CloudFormation there is a feature of termination protection:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack.html see --enable-termination-protection

Would it be possible to implement this feature in CDK so that one can set this flag and stack wouldn’t be allow to be destroyed?

[jewelsjacobs]

Hi folks.

This is a feature I’m also interested in. I was under the impression I could tag native CF commands on to the cdk cli but was disappointed to find that:

cdk deploy --enable-termination-protection (and different variations along those lines) did not work

I thought a cool workaround would be implementing some sort of cloudformation:DeleteStack Effect.DENY type Policy Doc. I was inspired by the iam policy document test in the cdk source: https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-iam/test/policy-document.test.ts#L62

Unfortunately my attempts to do anything similar were not successful. I couldn’t get the IAM changes to show up in the template, nor could I block any type of stack deletion attempts.

Here are my gists where I POCed it in a bare bones new cdk init app:

• Stack: https://gist.github.com/jewelsjacobs/9548f270e2c2b6a0926bcc8ac4e5f777
• App: https://gist.github.com/jewelsjacobs/a19be9daf50d931bc48061b59da5d2f0

My preferable solution in the end was to use an AWSCustomResource. It works very nicely. https://gist.github.com/jewelsjacobs/69dcad5e398075f60628322a591b105d

Sorry if this seems verbose but I’m including all of this info to:

1. Let you know either the policy doc or cli option would have worked for my use case
2. Give googlers something to search with 😃

[IsmaelMartinez]

@eladb , I think I might be able to pick this one up… but will need to have a bit of a view on integration tests.

If this is only for the client (cdk deploy --enable-termination-protection), it should not take me long. If it is both, meaning having something in the constructor, it will probably grow arms and legs and take a couple of months as it did happen with the tags.

As a workaround you can run the aws cli or sdk: https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-termination-protection.html https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudformation.html#CloudFormation.Client.update_termination_protection