cdk-cli: --quiet flag suppresses "Stack stack-name" messages also for stacks which do have changes #27128
Description
Describe the bug
I originally filed a feature request #26526 to suppress output of
Stack: my-stack
There were no differences
When you have a lot of stacks and want to know what will be change on deploy, those messages clutter the output and one might miss the real changes in between.
The --quiet flag was introduced in pull request 26652. Using this flag however, suppresses "Stack stackname" also for stacks which do have changes, so it's not clear anymore to which stack a change belongs.
Expected Behavior
Output without using the --quiet flag:
Stack euc1-ec2-bootstrap-s3-buckets
There were no differences
Stack euc1-gitlab-runner-2-ec2-instance
IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1.Arn} │ Allow │ sts:AssumeRole │ Service:ec2.amazonaws.com │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:secretsmanager:eu-central-1:030614601540:secret:ansible_bootstrap* │ Allow │ secretsmanager:GetSecretValue │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ {"Fn::ImportValue":"euc1-ec2-bootstrap-s3-buckets:ExportsOutputFnGetAtts303061460 │ Allow │ s3:GetObject │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
│ │ 1540euc1ec2bootstrap5CC677DFArn13EBC388"}/* │ │ s3:GetObjectVersion │ │ │
└───┴───────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────┬────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess │
└───┴────────────────────────────────────────────────┴────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────────────┬─────┬────────────┬─────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼───────────────────────────────────────────────────────────────────────┼─────┼────────────┼─────────────────┤
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 22 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 443 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴───────────────────────────────────────────────────────────────────────┴─────┴────────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}
Resources
[+] AWS::EC2::SecurityGroup security_group_private_euc1-gitlab-runner-2-ec2-instance_1 securitygroupprivateeuc1gitlabrunner2ec2instance1B2DBB269
[+] AWS::EC2::NetworkInterface eni_euc1-gitlab-runner-2-ec2-instance_private_1 enieuc1gitlabrunner2ec2instanceprivate1
[+] AWS::IAM::Role IAMRole_euc1_gitlab_runner_2_ec2_instance_1 IAMRoleeuc1gitlabrunner2ec2instance1AF79DDFE
[+] AWS::IAM::InstanceProfile IAMInstanceProfile_1 IAMInstanceProfile1
[+] AWS::EC2::Instance instance_euc1-gitlab-runner-2-ec2-instance_1 instanceeuc1gitlabrunner2ec2instance1
[+] AWS::Route53::RecordSet dns_euc1-gitlab-runner-2-ec2-instance_1 dnseuc1gitlabrunner2ec2instance15F8A8179
Other Changes
[+] Unknown Rules: {"CheckBootstrapVersion":{"Assertions":[{"Assert":{"Fn::Not":[{"Fn::Contains":[["1","2","3","4","5"],{"Ref":"BootstrapVersion"}]}]},"AssertDescription":"CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."}]}}
✨ Number of stacks with differences: 1
---
Output when using the `--quiet` flag:
```plaintext
Stack euc1-gitlab-runner-2-ec2-instance
IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1.Arn} │ Allow │ sts:AssumeRole │ Service:ec2.amazonaws.com │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:secretsmanager:eu-central-1:030614601540:secret:ansible_bootstrap* │ Allow │ secretsmanager:GetSecretValue │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ {"Fn::ImportValue":"euc1-ec2-bootstrap-s3-buckets:ExportsOutputFnGetAtts303061460 │ Allow │ s3:GetObject │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
│ │ 1540euc1ec2bootstrap5CC677DFArn13EBC388"}/* │ │ s3:GetObjectVersion │ │ │
└───┴───────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────┬────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess │
└───┴────────────────────────────────────────────────┴────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────────────┬─────┬────────────┬─────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼───────────────────────────────────────────────────────────────────────┼─────┼────────────┼─────────────────┤
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 22 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 443 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴───────────────────────────────────────────────────────────────────────┴─────┴────────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}
Resources
[+] AWS::EC2::SecurityGroup security_group_private_euc1-gitlab-runner-2-ec2-instance_1 securitygroupprivateeuc1gitlabrunner2ec2instance1B2DBB269
[+] AWS::EC2::NetworkInterface eni_euc1-gitlab-runner-2-ec2-instance_private_1 enieuc1gitlabrunner2ec2instanceprivate1
[+] AWS::IAM::Role IAMRole_euc1_gitlab_runner_2_ec2_instance_1 IAMRoleeuc1gitlabrunner2ec2instance1AF79DDFE
[+] AWS::IAM::InstanceProfile IAMInstanceProfile_1 IAMInstanceProfile1
[+] AWS::EC2::Instance instance_euc1-gitlab-runner-2-ec2-instance_1 instanceeuc1gitlabrunner2ec2instance1
[+] AWS::Route53::RecordSet dns_euc1-gitlab-runner-2-ec2-instance_1 dnseuc1gitlabrunner2ec2instance15F8A8179
Other Changes
[+] Unknown Rules: {"CheckBootstrapVersion":{"Assertions":[{"Assert":{"Fn::Not":[{"Fn::Contains":[["1","2","3","4","5"],{"Ref":"BootstrapVersion"}]}]},"AssertDescription":"CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."}]}}
✨ Number of stacks with differences: 1
Current Behavior
Output when using the --quiet flag:
IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1.Arn} │ Allow │ sts:AssumeRole │ Service:ec2.amazonaws.com │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:secretsmanager:eu-central-1:030614601540:secret:ansible_bootstrap* │ Allow │ secretsmanager:GetSecretValue │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ {"Fn::ImportValue":"euc1-ec2-bootstrap-s3-buckets:ExportsOutputFnGetAtts303061460 │ Allow │ s3:GetObject │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
│ │ 1540euc1ec2bootstrap5CC677DFArn13EBC388"}/* │ │ s3:GetObjectVersion │ │ │
└───┴───────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────┬────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess │
└───┴────────────────────────────────────────────────┴────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────────────┬─────┬────────────┬─────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼───────────────────────────────────────────────────────────────────────┼─────┼────────────┼─────────────────┤
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 22 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 443 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴───────────────────────────────────────────────────────────────────────┴─────┴────────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}
Resources
[+] AWS::EC2::SecurityGroup security_group_private_euc1-gitlab-runner-2-ec2-instance_1 securitygroupprivateeuc1gitlabrunner2ec2instance1B2DBB269
[+] AWS::EC2::NetworkInterface eni_euc1-gitlab-runner-2-ec2-instance_private_1 enieuc1gitlabrunner2ec2instanceprivate1
[+] AWS::IAM::Role IAMRole_euc1_gitlab_runner_2_ec2_instance_1 IAMRoleeuc1gitlabrunner2ec2instance1AF79DDFE
[+] AWS::IAM::InstanceProfile IAMInstanceProfile_1 IAMInstanceProfile1
[+] AWS::EC2::Instance instance_euc1-gitlab-runner-2-ec2-instance_1 instanceeuc1gitlabrunner2ec2instance1
[+] AWS::Route53::RecordSet dns_euc1-gitlab-runner-2-ec2-instance_1 dnseuc1gitlabrunner2ec2instance15F8A8179
Other Changes
[+] Unknown Rules: {"CheckBootstrapVersion":{"Assertions":[{"Assert":{"Fn::Not":[{"Fn::Contains":[["1","2","3","4","5"],{"Ref":"BootstrapVersion"}]}]},"AssertDescription":"CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."}]}}
✨ Number of stacks with differences: 1
Wed 13 Sep - 14:50 ~/coding/psc-application-nonprod-030614601540 origin ☊ CP-101---Setup-test-ec2-instance-running-a-CIS-hardened-Amazon-Linux-2023 1☀
@nomike cdk diff --profile=nonprod --concurrency=10 euc1-gitlab-runner-2-ec2-instance
WARNING:root:lb.LB is deprecated. Use alb.ALB or nlb.NLB instead.
Including dependency stacks: euc1-ec2-bootstrap-s3-buckets
[Warning at /euc1-gitlab-runner-2-ec2-instance/euc1-gitlab-runner-2-ec2-instance_interface_0_subnet_0] No routeTableId was provided to the subnet 'subnet-084047d8f0e5f97b2'. Attempting to read its .routeTable.routeTableId will return null/undefined. (More info: https://github.com/aws/aws-cdk/pull/3171)
Stack euc1-ec2-bootstrap-s3-buckets
There were no differences
Stack euc1-gitlab-runner-2-ec2-instance
IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1.Arn} │ Allow │ sts:AssumeRole │ Service:ec2.amazonaws.com │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:secretsmanager:eu-central-1:030614601540:secret:ansible_bootstrap* │ Allow │ secretsmanager:GetSecretValue │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
├───┼───────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ + │ {"Fn::ImportValue":"euc1-ec2-bootstrap-s3-buckets:ExportsOutputFnGetAtts303061460 │ Allow │ s3:GetObject │ AWS:${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ │
│ │ 1540euc1ec2bootstrap5CC677DFArn13EBC388"}/* │ │ s3:GetObjectVersion │ │ │
└───┴───────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────┬────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy │
│ + │ ${IAMRole_euc1_gitlab_runner_2_ec2_instance_1} │ arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess │
└───┴────────────────────────────────────────────────┴────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────────────┬─────┬────────────┬─────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼───────────────────────────────────────────────────────────────────────┼─────┼────────────┼─────────────────┤
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 22 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ In │ TCP 443 │ 10.0.0.0/8 │
│ + │ ${security_group_private_euc1-gitlab-runner-2-ec2-instance_1.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴───────────────────────────────────────────────────────────────────────┴─────┴────────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}
Resources
[+] AWS::EC2::SecurityGroup security_group_private_euc1-gitlab-runner-2-ec2-instance_1 securitygroupprivateeuc1gitlabrunner2ec2instance1B2DBB269
[+] AWS::EC2::NetworkInterface eni_euc1-gitlab-runner-2-ec2-instance_private_1 enieuc1gitlabrunner2ec2instanceprivate1
[+] AWS::IAM::Role IAMRole_euc1_gitlab_runner_2_ec2_instance_1 IAMRoleeuc1gitlabrunner2ec2instance1AF79DDFE
[+] AWS::IAM::InstanceProfile IAMInstanceProfile_1 IAMInstanceProfile1
[+] AWS::EC2::Instance instance_euc1-gitlab-runner-2-ec2-instance_1 instanceeuc1gitlabrunner2ec2instance1
[+] AWS::Route53::RecordSet dns_euc1-gitlab-runner-2-ec2-instance_1 dnseuc1gitlabrunner2ec2instance15F8A8179
Other Changes
[+] Unknown Rules: {"CheckBootstrapVersion":{"Assertions":[{"Assert":{"Fn::Not":[{"Fn::Contains":[["1","2","3","4","5"],{"Ref":"BootstrapVersion"}]}]},"AssertDescription":"CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."}]}}
✨ Number of stacks with differences: 1
Reproduction Steps
Introduce changes to your stacks, run cdk diff --quiet.
Possible Solution
I have written a wrapper for cdk in the past, which added parallel deployments (unfortunately company policy prevents me from sharing the source). I've added a feature like this in my code.
If the operating mode is "diff", the output for each stack is cached and printed all at once, once the stack is processed. This is to prevent the output of stacks becoming all mixed up. In other modes ("deploy", "destroy", ...) this caching does not happen, as you want to see immediately if something goes wrong, so you could introduce emergency counter-measures.
When the "--quiet" flag is present (I named it "--suppress-unchanged-stacks"), at the end of a stacks diff, the code checks whether the line ~"^There were no differences$" is part of the output and just skips printing it to the screen if it is.
As my script was an external wrapper I was fairly limited in how to do this. Thus that solution has a lot of short-comings and potential issues (e.g. it doesn't work at all with i18n or l10n).
I'm sure that inside the cdk codebase itself a much more resilient method could be found to assert whether there have been changes in a stack.
Additional Information/Context
No response
CDK CLI Version
2.94.0 (build 987c329)
Framework Version
No response
Node.js Version
v20.5.1
OS
Ubuntu 22.04.3 LTS
Language
Typescript, Python, .NET, Java, Go
Language Version
not applicable
Other information
No response