Describe the bug
I have a stack that creates a database with parameters group:
const parameterGroup = new ParameterGroup(this, 'ParameterGroup', {
...
}
const database = new DatabaseInstance(this, 'DatabaseInstance', {
parameterGroup: parameterGroup,
removalPolicy: RemovalPolicy.RETAIN,
...
})As you can see the database has removalPolicy property set to RETAIN because I want to leave the database after destroying this stack.
When I destroy this stack I see the following errors:
2:04:24 PM | DELETE_FAILED | AWS::RDS::DBParameterGroup | ParameterGroup5E32DECB
One or more database instances are still members of this parameter group xxx-database-parametergroup5e32decb-daetrwpaqpgw, so the group cannot be deleted (Service: Rd
s, Status Code: 400, Request ID: 389b18db-ea82-482b-a0e6-f64887da6f82)
2:19:21 PM | DELETE_FAILED | AWS::EC2::SecurityGroup | DatabaseInstanceSecurityGroup8BDF0112
resource sg-0bfc8aacb3d3e3d4a has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: 1eac5393-83df-48cf-bd75-41f25abb04
7a; Proxy: null)
As I understand the CF leaves the database but tries to destroy ParameterGroup and SecurtyGroup. I suppose this is the wrong behavior and CF should leave related ParameterGroup and SecurityGroup too.
I can create a custom SecurityGroup and change it remove policy use the applyRemovalPolicy method:
const securityGroup = new SecurityGroup(this, 'SecurityGroup', {
vpc: props.vpc,
allowAllOutbound: true,
})
securityGroup.applyRemovalPolicy(removalPolicy(SecurityGroup))
BUT I can't change the removal policy for a ParameterGroup in the same way because parameterGroup.applyRemovalPolicy(RemovalPolicy.RETAIN) raises the following error:
Error: Cannot apply RemovalPolicy: no child or not a CfnResource. Apply the removal policy on the CfnResource directly.
at ParameterGroup.applyRemovalPolicy (/Users/user/Projects/work/my-project/node_modules/aws-cdk-lib/core/lib/resource.js:1:2872)
at Database.createDatabase (/Users/user/Projects/work/my-project/src/stacks/billfold/database/index.ts:78:20)
at new Database (/Users/user/Projects/work/my-project/src/stacks/billfold/database/index.ts:36:27)
at new Billfold (/Users/user/Projects/work/my-project/src/stages/billfold.ts:66:22)
at Object.<anonymous> (/Users/user/Projects/work/my-project/src/apps/billfold.ts:10:1)
at Module._compile (node:internal/modules/cjs/loader:1105:14)
at Module.m._compile (/Users/user/Projects/work/my-project/node_modules/ts-node/src/index.ts:1618:23)
at Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
at Object.require.extensions.<computed> [as .ts] (/Users/user/Projects/work/my-project/node_modules/ts-node/src/index.ts:1621:12)
at Module.load (node:internal/modules/cjs/loader:981:32)
Expected Behavior
I can destroy a stack with a database that has removalPolicy property set to RemovalPolicy.RETAIN and has a relation to a parameter and security groups.
Current Behavior
The CF leaves the database but tries to destroy the related parameter group and security group and fails with the errors:
2:04:24 PM | DELETE_FAILED | AWS::RDS::DBParameterGroup | ParameterGroup5E32DECB
One or more database instances are still members of this parameter group billfold-database-parametergroup5e32decb-daetrwpaqpgw, so the group cannot be deleted (Service: Rd
s, Status Code: 400, Request ID: 389b18db-ea82-482b-a0e6-f64887da6f82)
2:19:21 PM | DELETE_FAILED | AWS::EC2::SecurityGroup | DatabaseInstanceSecurityGroup8BDF0112
resource sg-0bfc8aacb3d3e3d4a has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: 1eac5393-83df-48cf-bd75-41f25abb04
7a; Proxy: null)
Reproduction Steps
- Create a stack with database and parameter group using the following template:
const parameterGroup = new ParameterGroup(this, 'ParameterGroup', {
...
}
const database = new DatabaseInstance(this, 'DatabaseInstance', {
parameterGroup: parameterGroup,
removalPolicy: RemovalPolicy.RETAIN,
...
})
- Deploy this stack
- Destroy this stack
Possible Solution
I suppose:
- The
DatabaseInstance and DatabaseInstanceFromSnapshot constructs should propagate the removal policy to the related parameters and security groups.
- The
ParametersGroup#applyRemovalPolicy method should work and doesn't raise the error.
Additional Information/Context
No response
CDK CLI Version
2.39.0 (build e36bfe5)
Framework Version
No response
Node.js Version
v16.15.1
OS
macOS 12.4 (21F79)
Language
Typescript
Language Version
4.7.4
Other information
Looks like the #20649 issue is similar to this.
Describe the bug
I have a stack that creates a database with parameters group:
As you can see the database has
removalPolicyproperty set toRETAINbecause I want to leave the database after destroying this stack.When I destroy this stack I see the following errors:
As I understand the CF leaves the database but tries to destroy
ParameterGroupandSecurtyGroup. I suppose this is the wrong behavior and CF should leave relatedParameterGroupandSecurityGrouptoo.I can create a custom
SecurityGroupand change it remove policy use theapplyRemovalPolicymethod:BUT I can't change the removal policy for a
ParameterGroupin the same way becauseparameterGroup.applyRemovalPolicy(RemovalPolicy.RETAIN)raises the following error:Expected Behavior
I can destroy a stack with a database that has
removalPolicyproperty set toRemovalPolicy.RETAINand has a relation to a parameter and security groups.Current Behavior
The CF leaves the database but tries to destroy the related parameter group and security group and fails with the errors:
Reproduction Steps
Possible Solution
I suppose:
DatabaseInstanceandDatabaseInstanceFromSnapshotconstructs should propagate the removal policy to the related parameters and security groups.ParametersGroup#applyRemovalPolicymethod should work and doesn't raise the error.Additional Information/Context
No response
CDK CLI Version
2.39.0 (build e36bfe5)
Framework Version
No response
Node.js Version
v16.15.1
OS
macOS 12.4 (21F79)
Language
Typescript
Language Version
4.7.4
Other information
Looks like the #20649 issue is similar to this.