aws-cdk 2.1144.0 → 2.1145.0

package/README.md

@@ -207,6 +207,44 @@ $ cdk diff --app='node bin/main.js' MyStackName
 $ cdk diff --app='node bin/main.js' MyStackName --template=path/to/template.yml
 ```
 
+Use `--fail-on` to control which kind of change makes the command exit with code 1. It takes the same
+values as `cdk deploy --require-approval`:
+
+- `--fail-on=any-change`: fail on any difference. `--fail` is an alias for this value.
+- `--fail-on=broadening`: fail only on changes that broaden security permissions, such as new IAM
+  statements or security group rules. All differences are still shown.
+- `--fail-on=destructive`: fail only on changes that replace, delete or orphan an existing resource.
+  See below. `cdk deploy --require-approval=destructive` uses the same classification.
+- `--fail-on=never`: never fail. `--no-fail` is an alias for this value.
+
+```console
+# Fail in CI only when a change broadens security permissions
+$ cdk diff --fail-on=broadening
+```
+
+`--fail-on` cannot be combined with `--fail` or `--no-fail`. When none of them is given, the command does
+not fail, unless the `aws-cdk:enableDiffNoFail` feature flag is set to `false`, in which case it fails on
+any difference.
+
+`--fail-on=destructive` lists the resources that would be replaced, deleted or orphaned, and exits with
+code 1. Changes that update resources in place or add new resources do not cause a failure. This is
+useful in CI to stop changes that would lose data, such as a stateful resource whose logical ID
+changed after it was moved to another construct.
+
+```console
+$ cdk diff --fail-on=destructive MyStackName
+...
+❌  Found 1 destructive change(s) (--fail-on=destructive):
+  MyStackName: AWS::DynamoDB::Table MyTable MyTable794EDED1 will be orphaned
+```
+
+Whether a property change replaces the resource is determined by the change set, so use the default
+`--method=auto` or `--method=change-set` for accurate results. With `--method=template`, a change to
+a property that requires replacement is always reported as a replacement, and a change to a property
+that may require replacement is reported as "may be replaced", which also causes a failure.
+With `--security-only`, changes that are likely mangled non-ASCII characters are not filtered out,
+so they can also be reported as destructive.
+
 The stack header shows the environment the stack will be deployed to. For environment-agnostic
 stacks this is the resolved account and region, not `unknown-account`/`unknown-region`. It is
 omitted when diffing against a local template with `--template`, which does not contact AWS.
@@ -268,6 +306,27 @@ currently deployed stack to the template and tags that are about to be deployed
 will skip deployment if they are identical. Use `--force` to override this behavior
 and always deploy the stack.
 
+#### Requiring approval
+
+`--require-approval` (or `requireApproval` in `cdk.json`) controls which changes need a manual
+confirmation before they are deployed:
+
+- `never`: approval is never required.
+- `any-change`: approval is required for any change to the stack.
+- `broadening` (default): approval is required if changes broaden permissions or security group rules.
+- `destructive`: approval is required if changes replace, delete or orphan an existing resource,
+  including resources in nested stacks. The affected resources are listed before the confirmation.
+  Changes that only broaden permissions do not require approval in this mode. With `--method=direct`,
+  no change set is created, so a change to a property that may require replacement also requires approval.
+
+When approval is required but no terminal is attached, for example in CI, the deployment fails.
+Use `--yes` to confirm automatically.
+
+```console
+# Stop before anything is replaced or deleted, deploy everything else unattended
+$ cdk deploy --require-approval=destructive
+```
+
 #### Disabling Rollback
 
 If a resource fails to be created or updated, the deployment will *roll back* before the CLI returns. All changes made

package/THIRD_PARTY_LICENSES

@@ -5975,7 +5975,7 @@ Apache License
 
 ----------------
 
-** @aws-sdk/credential-providers@3.1140.0 - https://www.npmjs.com/package/@aws-sdk/credential-providers/v/3.1140.0 | Apache-2.0
+** @aws-sdk/credential-providers@3.1145.0 - https://www.npmjs.com/package/@aws-sdk/credential-providers/v/3.1145.0 | Apache-2.0
 Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -10936,7 +10936,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ----------------
 
-** cdk-from-cfn@0.334.0 - https://www.npmjs.com/package/cdk-from-cfn/v/0.334.0 | MIT OR Apache-2.0
+** cdk-from-cfn@0.336.0 - https://www.npmjs.com/package/cdk-from-cfn/v/0.336.0 | MIT OR Apache-2.0
 
 ----------------
 

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "comment": "Generated at 2026-09-30T20:21:29Z by generate.sh",
-  "commit": "b9c5274"
+  "comment": "Generated at 2026-10-08T00:44:21Z by generate.sh",
+  "commit": "13877dc"
 }

package/lib/api-private.d.ts

@@ -11,4 +11,3 @@ export * from '../../@aws-cdk/toolkit-lib/lib/api/tags/private';
 export * from '../../@aws-cdk/toolkit-lib/lib/private/activity-printer';
 export * from '../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/borrowed-assembly';
 export * from '../../@aws-cdk/toolkit-lib/lib/toolkit/private/count-assembly-results';
-export { throwIfValidationFailures } from '../../@aws-cdk/toolkit-lib/lib/toolkit/private/validation-report';

package/lib/api-private.js

@@ -36,7 +36,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.throwIfValidationFailures = exports.formatExpressStabilizationWarning = exports.createIgnoreMatcher = exports.Diagnosis = exports.ChangeSetDescriber = exports.cfnApi = exports.deployStack = void 0;
+exports.formatExpressStabilizationWarning = exports.createIgnoreMatcher = exports.Diagnosis = exports.ChangeSetDescriber = exports.cfnApi = exports.deployStack = void 0;
 /* eslint-disable import/no-relative-packages */
 var deploy_stack_1 = require("../../@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack");
 Object.defineProperty(exports, "deployStack", { enumerable: true, get: function () { return deploy_stack_1.deployStack; } });
@@ -54,6 +54,4 @@ __exportStar(require("../../@aws-cdk/toolkit-lib/lib/api/tags/private"), exports
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/private/activity-printer"), exports);
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/api/cloud-assembly/private/borrowed-assembly"), exports);
 __exportStar(require("../../@aws-cdk/toolkit-lib/lib/toolkit/private/count-assembly-results"), exports);
-var validation_report_1 = require("../../@aws-cdk/toolkit-lib/lib/toolkit/private/validation-report");
-Object.defineProperty(exports, "throwIfValidationFailures", { enumerable: true, get: function () { return validation_report_1.throwIfValidationFailures; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLXByaXZhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhcGktcHJpdmF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxnREFBZ0Q7QUFDaEQsNEZBQTBGO0FBQWpGLDJHQUFBLFdBQVcsT0FBQTtBQUVwQixpR0FBaUY7QUFDakYsOEVBQW9GO0FBQTNFLGlIQUFBLGtCQUFrQixPQUFBO0FBQzNCLHFGQUFvRjtBQUEzRSxzR0FBQSxTQUFTLE9BQUE7QUFFbEIsaUZBQXVGO0FBQTlFLG1IQUFBLG1CQUFtQixPQUFBO0FBQzVCLCtFQUFvRztBQUEzRixnSUFBQSxpQ0FBaUMsT0FBQTtBQUMxQyxnRkFBOEQ7QUFDOUQsa0ZBQWdFO0FBQ2hFLDBGQUF3RTtBQUN4RSw4R0FBNEY7QUFDNUYsd0dBQXNGO0FBQ3RGLHNHQUE2RztBQUFwRyw4SEFBQSx5QkFBeUIsT0FBQSIsInNvdXJjZXNDb250ZW50IjpbIi8qIGVzbGludC1kaXNhYmxlIGltcG9ydC9uby1yZWxhdGl2ZS1wYWNrYWdlcyAqL1xuZXhwb3J0IHsgZGVwbG95U3RhY2sgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RlcGxveW1lbnRzL2RlcGxveS1zdGFjayc7XG5leHBvcnQgdHlwZSB7IERlcGxveVN0YWNrT3B0aW9ucyBhcyBEZXBsb3lTdGFja0FwaU9wdGlvbnMsIERlc3Ryb3lTdGFja1Jlc3VsdCB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvZGVwbG95LXN0YWNrJztcbmV4cG9ydCAqIGFzIGNmbkFwaSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RlcGxveW1lbnRzL2Nmbi1hcGknO1xuZXhwb3J0IHsgQ2hhbmdlU2V0RGVzY3JpYmVyIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jaGFuZ2Utc2V0cyc7XG5leHBvcnQgeyBEaWFnbm9zaXMgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2RpYWdub3NpbmcvZGlhZ25vc2lzJztcbmV4cG9ydCB0eXBlIHsgQ2hhbmdlU2V0UmVwb3J0IH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jaGFuZ2Utc2V0cyc7XG5leHBvcnQgeyBjcmVhdGVJZ25vcmVNYXRjaGVyIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL3V0aWwvZ2xvYi1tYXRjaGVyJztcbmV4cG9ydCB7IGZvcm1hdEV4cHJlc3NTdGFiaWxpemF0aW9uV2FybmluZyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi91dGlsL2Nmbi1leHByZXNzJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvaW8vcHJpdmF0ZSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL3RhZ3MvcHJpdmF0ZSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvcHJpdmF0ZS9hY3Rpdml0eS1wcmludGVyJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvY2xvdWQtYXNzZW1ibHkvcHJpdmF0ZS9ib3Jyb3dlZC1hc3NlbWJseSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvdG9vbGtpdC9wcml2YXRlL2NvdW50LWFzc2VtYmx5LXJlc3VsdHMnO1xuZXhwb3J0IHsgdGhyb3dJZlZhbGlkYXRpb25GYWlsdXJlcyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi90b29sa2l0L3ByaXZhdGUvdmFsaWRhdGlvbi1yZXBvcnQnO1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLXByaXZhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhcGktcHJpdmF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxnREFBZ0Q7QUFDaEQsNEZBQTBGO0FBQWpGLDJHQUFBLFdBQVcsT0FBQTtBQUVwQixpR0FBaUY7QUFDakYsOEVBQW9GO0FBQTNFLGlIQUFBLGtCQUFrQixPQUFBO0FBQzNCLHFGQUFvRjtBQUEzRSxzR0FBQSxTQUFTLE9BQUE7QUFFbEIsaUZBQXVGO0FBQTlFLG1IQUFBLG1CQUFtQixPQUFBO0FBQzVCLCtFQUFvRztBQUEzRixnSUFBQSxpQ0FBaUMsT0FBQTtBQUMxQyxnRkFBOEQ7QUFDOUQsa0ZBQWdFO0FBQ2hFLDBGQUF3RTtBQUN4RSw4R0FBNEY7QUFDNUYsd0dBQXNGIiwic291cmNlc0NvbnRlbnQiOlsiLyogZXNsaW50LWRpc2FibGUgaW1wb3J0L25vLXJlbGF0aXZlLXBhY2thZ2VzICovXG5leHBvcnQgeyBkZXBsb3lTdGFjayB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvZGVwbG95LXN0YWNrJztcbmV4cG9ydCB0eXBlIHsgRGVwbG95U3RhY2tPcHRpb25zIGFzIERlcGxveVN0YWNrQXBpT3B0aW9ucywgRGVzdHJveVN0YWNrUmVzdWx0IH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9kZXBsb3ltZW50cy9kZXBsb3ktc3RhY2snO1xuZXhwb3J0ICogYXMgY2ZuQXBpIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGVwbG95bWVudHMvY2ZuLWFwaSc7XG5leHBvcnQgeyBDaGFuZ2VTZXREZXNjcmliZXIgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2NoYW5nZS1zZXRzJztcbmV4cG9ydCB7IERpYWdub3NpcyB9IGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGlhZ25vc2luZy9kaWFnbm9zaXMnO1xuZXhwb3J0IHR5cGUgeyBDaGFuZ2VTZXRSZXBvcnQgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2NoYW5nZS1zZXRzJztcbmV4cG9ydCB7IGNyZWF0ZUlnbm9yZU1hdGNoZXIgfSBmcm9tICcuLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvdXRpbC9nbG9iLW1hdGNoZXInO1xuZXhwb3J0IHsgZm9ybWF0RXhwcmVzc1N0YWJpbGl6YXRpb25XYXJuaW5nIH0gZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL3V0aWwvY2ZuLWV4cHJlc3MnO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9pby9wcml2YXRlJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvdGFncy9wcml2YXRlJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9wcml2YXRlL2FjdGl2aXR5LXByaW50ZXInO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9jbG91ZC1hc3NlbWJseS9wcml2YXRlL2JvcnJvd2VkLWFzc2VtYmx5JztcbmV4cG9ydCAqIGZyb20gJy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi90b29sa2l0L3ByaXZhdGUvY291bnQtYXNzZW1ibHktcmVzdWx0cyc7XG4iXX0=

package/lib/cli/cdk-toolkit.d.ts

@@ -285,11 +285,16 @@ export interface DiffOptions {
      */
     readonly contextLines?: number;
     /**
-     * Whether to fail with exit code 1 in case of diff
+     * Which kind of change makes the diff fail with exit code 1
      *
-     * @default false
+     * - `any-change`: any difference
+     * - `broadening`: a change that broadens security permissions
+     * - `destructive`: a change that replaces, deletes or orphans an existing resource
+     * - `never`: the diff never fails
+     *
+     * @default RequireApproval.NEVER
      */
-    readonly fail?: boolean;
+    readonly failOn?: RequireApproval;
     /**
      * Only run diff on broadened security changes
      *
@@ -386,6 +391,11 @@ export interface CliValidateOptions extends ValidateOptions {
     readonly watch?: boolean;
 }
 interface WatchOptions extends Omit<CfnDeployOptions, 'execute'> {
+    /**
+     * Path to file where stack outputs will be written after a successful deploy as JSON
+     * @default - Outputs are not written to any file
+     */
+    outputsFile?: string;
     /**
      * Reuse the assets with the given asset IDs
      */
@@ -446,11 +456,6 @@ export interface DeployOptions extends CfnDeployOptions, WatchOptions {
      * @default true
      */
     usePreviousParameters?: boolean;
-    /**
-     * Path to file where stack outputs will be written after a successful deploy as JSON
-     * @default - Outputs are not written to any file
-     */
-    outputsFile?: string;
     /**
      * Whether we are on a CI system
      *