feat(appconfig): environment deletion protection #32737

badmintoncryer · 2025-01-04T12:47:13Z

Issue # (if applicable)

None

Reason for this change

AWS AppConfig environment supports deletion protection and this feature is not configurable from AWS CDK.

Description of changes

Add DeletionProtectionCheck enum
Add deletionProtectionCheck prop to EnvironmentOption

There are two entities, EnvironmentOptions and EnvironmentProps, where EnvironmentProps is designed as an extension of EnvironmentOptions with the addition of an application prop.

export interface EnvironmentProps extends EnvironmentOptions {
  /**
   * The application to be associated with the environment.
   */
  readonly application: IApplication;
}

abstract class ApplicationBase extends cdk.Resource implements IApplication, IExtensible {
  public addEnvironment(id: string, options: EnvironmentOptions = {}): IEnvironment {
    return new Environment(this, id, {
      application: this,
      ...options,
    });
  }

Therefore, the current argument addition has also been made to EnvironmentOptions.

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

codecov · 2025-01-04T13:00:08Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.52%. Comparing base (8a96454) to head (43623bc).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32737   +/-   ##
=======================================
  Coverage   81.52%   81.52%           
=======================================
  Files         222      222           
  Lines       13715    13715           
  Branches     2417     2417           
=======================================
  Hits        11181    11181           
  Misses       2254     2254           
  Partials      280      280

Flag	Coverage Δ
suite.unit	`81.52% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`80.97% <ø> (ø)`
packages/aws-cdk-lib/core	`82.09% <ø> (ø)`

mazyu36

Thank you for the contribution.
I've left some comments.

I'm not very familiar with this property, so please correct me if I'm wrong.

mazyu36 · 2025-01-06T02:47:14Z

packages/aws-cdk-lib/aws-appconfig/README.md

+
+You can enable [deletion protection](https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html) on the environment by setting the `deletionProtection` property.
+
+- ACCOUNT_DEFAULT:  The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.


Very very nit:

Suggested change

- ACCOUNT_DEFAULT: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.

- ACCOUNT_DEFAULT: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.

I understand this sentence means the following, is that correct?

Use account-level settings when ACCOUNT_DEFAULT is set.

If users want to enable account-level deletion protection, they need to use the UpdateAccountSettings API via AWS CLI or another tool.

The current explanation seems to be taken from the docs, but I think an explanation like the one below would be clearer. What do you think?

The default setting, which uses account-level deletion protection. To configure account-level deletion protection, use the UpdateAccountSettings API.

mazyu36 · 2025-01-06T02:57:33Z

packages/aws-cdk-lib/aws-appconfig/README.md

+
+- ACCOUNT_DEFAULT:  The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.
+- APPLY: Instructs the deletion protection check to run, even if deletion protection is disabled at the account level. APPLY also forces the deletion protection check to run against resources created in the past hour, which are normally excluded from deletion protection checks.
+- BYPASS: Instructs AWS AppConfig to bypass the deletion protection check and delete a configuration profile even if deletion protection would have otherwise prevented it.


Just to clarify, if deletion protection is applied to an environment, is the protected resource the environment itself or a configuration set?

I'm not sure if "configuration profile" is the correct term in this context.

mazyu36 · 2025-01-06T03:10:10Z

packages/aws-cdk-lib/aws-appconfig/lib/environment.ts

@@ -141,6 +141,32 @@ abstract class EnvironmentBase extends Resource implements IEnvironment, IExtens
  }
 }

+/**


In my understanding, this enum is required for the configuration profile.

Therefore, I think it would be better to separate this enum into another file (e.g., util.ts).

badmintoncryer · 2025-01-06T12:35:52Z

@mazyu36 Thank you very much for your review! All of your comments are spot-on and provide appropriate feedback.

I've addressed all the discussions.

mazyu36

Thank you for the modification.
Just two more comments.

packages/aws-cdk-lib/aws-appconfig/lib/private/util.ts

Co-authored-by: Matsuda <[email protected]>

badmintoncryer · 2025-01-07T13:12:40Z

@mazyu36 Thank you for your reveiw! And I'm sorry for my rough edits.

mazyu36

Thanks! LGTM

godwingrs22

Thanks @badmintoncryer for your contribution. LGTM. just left one nit comment.

godwingrs22 · 2025-01-08T23:47:13Z

packages/aws-cdk-lib/aws-appconfig/README.md

@@ -96,6 +96,24 @@ const user = new iam.User(this, 'MyUser');
 env.grantReadConfig(user);
 ```

+### Deletion Protection Check
+
+You can enable [deletion protection](https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html) on the environment by setting the `deletionProtection` property.


nit: seems typo. Are you referring to deletionProtectionCheck property

Thnak you for your review! I've fixed this typo.

aws-cdk-automation · 2025-01-09T01:25:41Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 43623bc
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

badmintoncryer added 2 commits January 4, 2025 21:18

deletion protection check for an environment

548e5d6

add readme

4d6daab

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Jan 4, 2025

aws-cdk-automation requested a review from a team January 4, 2025 12:47

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 4, 2025

badmintoncryer changed the title ~~feat(appconfig): deletion protection for AppConfig Environment~~ feat(appconfig): deletion protection for an Environment Jan 4, 2025

Merge branch 'main' into deletion-protection-check-for-environment

a076e34

badmintoncryer changed the title ~~feat(appconfig): deletion protection for an Environment~~ feat(appconfig): environment deletion protection Jan 5, 2025

mazyu36 suggested changes Jan 6, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 6, 2025

refactor

3121a7f

Merge branch 'main' into deletion-protection-check-for-environment

85cd989

mazyu36 suggested changes Jan 6, 2025

View reviewed changes

packages/aws-cdk-lib/aws-appconfig/lib/private/util.ts Outdated Show resolved Hide resolved

packages/aws-cdk-lib/aws-appconfig/lib/private/util.ts Outdated Show resolved Hide resolved

badmintoncryer and others added 4 commits January 7, 2025 22:07

Update packages/aws-cdk-lib/aws-appconfig/lib/private/util.ts

4a8329e

Co-authored-by: Matsuda <[email protected]>

Update packages/aws-cdk-lib/aws-appconfig/lib/private/util.ts

f3bf9ea

Co-authored-by: Matsuda <[email protected]>

refactor

a3653ad

fix

589a736

Merge branch 'main' into deletion-protection-check-for-environment

4a6f4ca

mazyu36 approved these changes Jan 7, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 7, 2025

godwingrs22 reviewed Jan 8, 2025

View reviewed changes

badmintoncryer added 2 commits January 9, 2025 09:52

update readme

29d7890

Merge branch 'main' into deletion-protection-check-for-environment

43623bc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(appconfig): environment deletion protection #32737

feat(appconfig): environment deletion protection #32737

badmintoncryer commented Jan 4, 2025

codecov bot commented Jan 4, 2025 •

edited

Loading

mazyu36 left a comment

mazyu36 Jan 6, 2025

mazyu36 Jan 6, 2025

mazyu36 Jan 6, 2025

mazyu36 Jan 6, 2025

badmintoncryer commented Jan 6, 2025

mazyu36 left a comment

badmintoncryer commented Jan 7, 2025

mazyu36 left a comment

godwingrs22 left a comment

godwingrs22 Jan 8, 2025

badmintoncryer Jan 9, 2025

aws-cdk-automation commented Jan 9, 2025


		You can enable [deletion protection](https://docs.aws.amazon.com/appconfig/latest/userguide/deletion-protection.html) on the environment by setting the `deletionProtection` property.

		- ACCOUNT_DEFAULT: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.

                 }
               }
+              /**

feat(appconfig): environment deletion protection #32737

Are you sure you want to change the base?

feat(appconfig): environment deletion protection #32737

Conversation

badmintoncryer commented Jan 4, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

codecov bot commented Jan 4, 2025 • edited Loading

Codecov Report

mazyu36 left a comment

Choose a reason for hiding this comment

mazyu36 Jan 6, 2025

Choose a reason for hiding this comment

mazyu36 Jan 6, 2025

Choose a reason for hiding this comment

mazyu36 Jan 6, 2025

Choose a reason for hiding this comment

mazyu36 Jan 6, 2025

Choose a reason for hiding this comment

badmintoncryer commented Jan 6, 2025

mazyu36 left a comment

Choose a reason for hiding this comment

badmintoncryer commented Jan 7, 2025

mazyu36 left a comment

Choose a reason for hiding this comment

godwingrs22 left a comment

Choose a reason for hiding this comment

godwingrs22 Jan 8, 2025

Choose a reason for hiding this comment

badmintoncryer Jan 9, 2025

Choose a reason for hiding this comment

aws-cdk-automation commented Jan 9, 2025

AWS CodeBuild CI Report

codecov bot commented Jan 4, 2025 •

edited

Loading