(pipelines): view `cdk diff` output in CodePipeline

It would be awesome to be able to see the results of cdk diff in the CodePipeline UI along with a manual approval step before infrastructure changes are deployed by CDK Pipelines.

Use Case

CDK Pipelines are great. I love that there’s an officially supported way to deploy CDK from a CI-environment vs. people’s local machines. In fact, I created a system for a client that does this with Circle CI before pipelines were available. Eventually, it would be great to move clients over to the officially supported pipelines module from the custom solution.

The one thing that’s missing from the current solution, IMO, is the ability to view the cdk diff output in CodePipeline before mutating infrastructure.

Imagine that I’m a developer working on a CDK-managed RDS cluster. Some CloudFormation properties, when updated, require replacement of the Database instance and cannot be performed in-place. Imagine a developer gets their PR approved and merges without running a cdk diff locally, first. Suddenly, they could be in for a big surprise when the RDS cluster is being recreated by CloudFormation.

This situation could be prevented if the developer would have checked out the cdk diff before mutating the infrastructure. The red REQUIRES REPLACEMENT message would have tipped them off that they should look into other ways of accomplishing their update.

This is just one example. It’s always a good idea to check out the cdk diff before updating your infrastructure.

Proposed Solution

One way to accomplish this would be to create a CodePipeline stage for running cdk diff. It could use CodeBuild to execute cdk diff, just like it does to run cdk synth. Then, a manual approval step could optionally be added, linking to the CodeBuild output with the cdk diff. If the diff looks OK, the user approves and the applicationStage is deployed. If something looks wrong, the user could reject and fix the problem.

Other

The CodePipeline would look something like this:

Source
|
Build
|
Diff
|-- optional manual approval
|
Update Pipeline
|
Application Stage

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[blimmer]

@Simon-SDK - to see the diffs for your stages, you have to run something like:

> cdk diff -a cdk.out/assembly-MyPipeline-MyStage

It’ll be different based on the names in your project. This is also reported in #8676, which is marked for GA.

[ahammond]

I think that having an option to “generate the changeset then wait for manual approval” would be Good Enough. Ideally, I’d want to set it at the wave level:

So I’d be able to write something like

const manualApprovalAfterCreateChangeSet = new pipelines.ManualApprovalStep('Approve Changeset', {...});
const myWave = myPipeline.addWave('MyWaveName', { manualApprovalAfterCreateChangeSet });
// add stages to wave

And… almost certainly this should be part of an interface which is common to wave and stage.