fix(analyzer): delete AWS::CloudWatch::CompositeAlarm before the metric Alarms its AlarmRule references

A CompositeAlarm references its child alarms by NAME inside its AlarmRule
string (e.g. ALARM("cdkd-getatt-chain-alarm")), which is a plain string with
no Ref / Fn::GetAtt, so cdkd's DAG saw no dependency edge and could schedule
the referenced metric alarm for deletion while the composite still existed.
CloudWatch rejects that with "Cannot delete <alarm> as there are composite
alarm(s) depending on it." and the destroy failed.

Add a per-resource implicit delete-ordering edge: parse each CompositeAlarm's
AlarmRule for referenced alarm names (ALARM / OK / INSUFFICIENT_DATA tokens,
bare or quoted, plus the arn:...:alarm:<name> form) and emit an edge making the
composite alarm delete BEFORE every metric/composite Alarm it references in the
same stack (matched by AlarmName property or physical id). The per-AlarmRule
edge handles composite-of-composite chains. Both delete consumers (the deploy
engine DELETE phase and the standalone destroy command) add these edges
alongside the existing type-pair rules.

Adds computeImplicitDeleteEdges / extractReferencedAlarmNames to
src/analyzer/implicit-delete-deps.ts plus unit tests for the parser and the
edge computation (bare/quoted/ARN names, multi-reference rules,
composite-of-composite, self-cycle guard, references outside the delete set).

Author: go-to-k

.claude/rules/analyzer.md

@@ -32,5 +32,5 @@ paths:
 - Determines execution order with topological sort
 - **Implicit edge for Custom Resources**: any `AWS::IAM::Policy` / `AWS::IAM::RolePolicy` / `AWS::IAM::ManagedPolicy` attached to a Custom Resource's ServiceToken Lambda execution role automatically gets an edge to the Custom Resource, preventing the handler from being invoked before inline policy attachment returns (avoids mid-deploy AccessDenied race)
 - **Implicit edge for Lambda VpcConfig**: every `AWS::EC2::Subnet` / `AWS::EC2::SecurityGroup` referenced by a Lambda's `Properties.VpcConfig.SubnetIds` / `SecurityGroupIds` gets an explicit edge to the Lambda (`src/analyzer/lambda-vpc-deps.ts`). Defense-in-depth on top of `extractDependencies`; for the reversed deletion traversal this guarantees Lambda is removed before its Subnet/SG so the asynchronous ENI detach has time to complete before EC2 rejects the subnet/SG delete with `DependencyViolation`.
-- **Type-based deletion ordering rules**: `src/analyzer/implicit-delete-deps.ts` centralizes type-pair rules (e.g. VPC after Subnet, Subnet after Lambda, IGW + VPCGatewayAttachment after NatGateway) shared by the deploy DELETE phase and the standalone destroy command. The IGW / VPCGatewayAttachment after NatGateway edge (issue [#817](https://github.com/go-to-k/cdkd/issues/817)) mirrors the NAT-before-IGW ordering CloudFormation enforces: a NAT Gateway holds an Elastic IP mapped to the VPC's public address space, so detaching the IGW before the NAT is gone fails with `Network vpc-xxx has some mapped public address(es)` and the IGW delete then hangs (~19 min observed). No type-based rule is needed for the EIP itself — the NAT Ref's its EIP via `AllocationId`, so the reversed delete traversal already deletes the NAT before the EIP is released.
+- **Type-based deletion ordering rules**: `src/analyzer/implicit-delete-deps.ts` centralizes type-pair rules (e.g. VPC after Subnet, Subnet after Lambda, IGW + VPCGatewayAttachment after NatGateway) shared by the deploy DELETE phase and the standalone destroy command. The IGW / VPCGatewayAttachment after NatGateway edge (issue [#817](https://github.com/go-to-k/cdkd/issues/817)) mirrors the NAT-before-IGW ordering CloudFormation enforces: a NAT Gateway holds an Elastic IP mapped to the VPC's public address space, so detaching the IGW before the NAT is gone fails with `Network vpc-xxx has some mapped public address(es)` and the IGW delete then hangs (~19 min observed). No type-based rule is needed for the EIP itself — the NAT Ref's its EIP via `AllocationId`, so the reversed delete traversal already deletes the NAT before the EIP is released. The same module also exposes `computeImplicitDeleteEdges(resources)` for per-RESOURCE delete-ordering edges no type-pair rule can express: an `AWS::CloudWatch::CompositeAlarm` references its child alarms (metric `AWS::CloudWatch::Alarm` or other composite alarms) by NAME inside its `AlarmRule` string (`ALARM("name")` / `OK(name)` / `INSUFFICIENT_DATA(name)`, plus the `arn:...:alarm:<name>` form) — a plain string, so cdkd's DAG sees no `Ref` / `Fn::GetAtt` edge. `extractReferencedAlarmNames` parses those names and the helper emits an edge making the composite alarm delete BEFORE each referenced alarm (matched by `AlarmName` property or physical id), since CloudWatch rejects deleting a metric alarm while a composite alarm still references it (`Cannot delete <alarm> as there are composite alarm(s) depending on it.`). The per-AlarmRule edge handles composite-of-composite chains; both delete consumers add these edges alongside the type-pair rules.
 - **CDK-defensive DependsOn relaxation (default-on)**: `src/analyzer/cdk-defensive-deps.ts` lists the (depender, dependee) type pairs CDK adds defensively for VPC-Lambda runtime egress (IAM Role / Policy / Lambda::Function / Lambda::Url / Lambda::EventSourceMapping → EC2 Route / SubnetRouteTableAssociation). The deploy code path constructs `DagBuilder({ relaxCdkVpcDefensiveDeps: true })` by default; the matching DependsOn edges are dropped at graph-build time so CloudFront Distribution + Lambda::Url + VPC Lambda dispatch in parallel with NAT Gateway stabilization (~55% faster on `bench-cdk-sample`). Pass `cdkd deploy --no-aggressive-vpc-parallel` to opt out (escape hatch for stacks where the user wants the strict CDK-defensive ordering — e.g. a Custom Resource that synchronously invokes a VPC Lambda outside cdkd's Lambda-ServiceToken Active wait). Only DependsOn entries in the allowlist are dropped — Ref / GetAtt and other DependsOn pairs are untouched.

src/analyzer/implicit-delete-deps.ts

@@ -74,3 +74,137 @@ export const IMPLICIT_DELETE_DEPENDENCIES: Record<string, readonly string[]> = {
     'AWS::Lambda::Function',
   ],
 };
+
+/**
+ * A single implicit delete-ordering edge: the resource at `before` (logical id)
+ * must finish deleting BEFORE the resource at `after` (logical id).
+ *
+ * Unlike {@link IMPLICIT_DELETE_DEPENDENCIES} (which expresses ordering between
+ * TYPES, so every instance of type X orders against every instance of type Y),
+ * these edges are computed per-RESOURCE — they are derived from the actual
+ * references one resource carries, so they can express "this specific composite
+ * alarm before this specific metric alarm" without forcing an all-pairs rule.
+ */
+export interface ImplicitDeleteEdge {
+  /** Logical id of the resource that must be deleted first. */
+  before: string;
+  /** Logical id of the resource that must be deleted after `before`. */
+  after: string;
+}
+
+/**
+ * A resource as seen by the delete-ordering computation. Both the deploy DELETE
+ * phase (`StackState.resources[id]`) and the standalone destroy command shape
+ * carry these fields, so this is the common subset both call sites can pass.
+ */
+export interface DeleteOrderingResource {
+  resourceType: string;
+  physicalId?: string;
+  properties?: Record<string, unknown>;
+}
+
+/**
+ * Matches one alarm-state function token in a CompositeAlarm `AlarmRule`:
+ *   ALARM("name") | OK('name') | INSUFFICIENT_DATA(name)
+ * The argument is captured raw (with any surrounding quotes) and trimmed /
+ * unquoted by {@link extractReferencedAlarmNames}. CloudWatch also accepts the
+ * boolean literals TRUE / FALSE which carry no argument, so they never match.
+ */
+const ALARM_RULE_FUNCTION_REGEX =
+  /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
+
+/**
+ * Extract every alarm NAME (or ARN) referenced by a CompositeAlarm `AlarmRule`
+ * string. The rule references its child alarms by NAME (or ARN) as a plain
+ * string — there is no `Ref` / `Fn::GetAtt`, so cdkd's DAG sees no dependency
+ * edge from these references. We parse them out so a delete-ordering edge can be
+ * synthesized (CloudWatch refuses to delete a metric alarm while a composite
+ * alarm still references it).
+ *
+ * Handles the three alarm-state functions (`ALARM` / `OK` / `INSUFFICIENT_DATA`)
+ * and both the bare-name and quoted-name forms. An ARN argument
+ * (`arn:aws:cloudwatch:...:alarm:<name>`) is reduced to its trailing `<name>`
+ * so it can be matched against a referenced alarm's `AlarmName` / physical id
+ * the same way a bare name is.
+ */
+export function extractReferencedAlarmNames(alarmRule: string): string[] {
+  const names = new Set<string>();
+  for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
+    let arg = (match[1] ?? '').trim();
+    if (arg.length === 0) continue;
+    // Strip a single pair of surrounding quotes (single or double).
+    if (
+      (arg.startsWith('"') && arg.endsWith('"')) ||
+      (arg.startsWith("'") && arg.endsWith("'"))
+    ) {
+      arg = arg.slice(1, -1);
+    }
+    if (arg.length === 0) continue;
+    // ARN form: arn:aws:cloudwatch:<region>:<acct>:alarm:<name> — reduce to the
+    // trailing name so it matches an AlarmName / physical id.
+    const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
+    if (arnAlarmMatch?.[1]) {
+      names.add(arnAlarmMatch[1]);
+    } else {
+      names.add(arg);
+    }
+  }
+  return [...names];
+}
+
+/**
+ * Compute per-resource delete-ordering edges that cannot be inferred from
+ * Ref / Fn::GetAtt edges or from the type-pair {@link IMPLICIT_DELETE_DEPENDENCIES}
+ * table.
+ *
+ * Currently this synthesizes edges for `AWS::CloudWatch::CompositeAlarm`: a
+ * composite alarm references its child alarms (metric `AWS::CloudWatch::Alarm`
+ * or other composite alarms) by NAME inside its `AlarmRule` string. Because the
+ * reference is a plain string (no `Ref` / `Fn::GetAtt`), cdkd's DAG sees no
+ * dependency edge, so without this the metric alarm can be scheduled for
+ * deletion while the composite still exists — and CloudWatch rejects that with
+ * `Cannot delete <alarm> as there are composite alarm(s) depending on it.`
+ * We therefore emit an edge making the composite alarm delete BEFORE every
+ * alarm its `AlarmRule` references (handling composite-of-composite too).
+ *
+ * @param resources logical id -> resource (the subset of resources participating
+ *   in the delete). Only entries whose logical id is a key in this record are
+ *   considered as edge endpoints.
+ */
+export function computeImplicitDeleteEdges(
+  resources: Record<string, DeleteOrderingResource>
+): ImplicitDeleteEdge[] {
+  const edges: ImplicitDeleteEdge[] = [];
+
+  // Index alarm resources (metric + composite) by the name a CompositeAlarm's
+  // AlarmRule would reference them by: their AlarmName property if set, else
+  // their physical id (CloudWatch alarm physical id IS the alarm name).
+  const alarmTypes = new Set(['AWS::CloudWatch::Alarm', 'AWS::CloudWatch::CompositeAlarm']);
+  const nameToLogicalId = new Map<string, string>();
+  for (const [logicalId, resource] of Object.entries(resources)) {
+    if (!alarmTypes.has(resource.resourceType)) continue;
+    const alarmName =
+      typeof resource.properties?.['AlarmName'] === 'string'
+        ? (resource.properties['AlarmName'] as string)
+        : resource.physicalId;
+    if (alarmName) nameToLogicalId.set(alarmName, logicalId);
+  }
+
+  for (const [logicalId, resource] of Object.entries(resources)) {
+    if (resource.resourceType !== 'AWS::CloudWatch::CompositeAlarm') continue;
+    const alarmRule = resource.properties?.['AlarmRule'];
+    if (typeof alarmRule !== 'string') continue;
+
+    for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
+      const referencedLogicalId = nameToLogicalId.get(referencedName);
+      // Skip names we can't resolve to a same-stack resource and skip a
+      // self-reference (a composite alarm cannot reference itself, but guard
+      // against it so we never emit a self-cycle).
+      if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
+      // The composite (logicalId) must be deleted BEFORE the referenced alarm.
+      edges.push({ before: logicalId, after: referencedLogicalId });
+    }
+  }
+
+  return edges;
+}

src/cli/commands/destroy-runner.ts

@@ -7,7 +7,10 @@ import { setAwsClients, AwsClients } from '../../utils/aws-clients.js';
 import type { S3StateBackend } from '../../state/s3-state-backend.js';
 import type { LockManager } from '../../state/lock-manager.js';
 import { DagBuilder } from '../../analyzer/dag-builder.js';
-import { IMPLICIT_DELETE_DEPENDENCIES } from '../../analyzer/implicit-delete-deps.js';
+import {
+  IMPLICIT_DELETE_DEPENDENCIES,
+  computeImplicitDeleteEdges,
+} from '../../analyzer/implicit-delete-deps.js';
 import { ProviderRegistry } from '../../provisioning/provider-registry.js';
 import { registerAllProviders } from '../../provisioning/register-providers.js';
 import { shouldRetainResource, type ResourceState, type StackState } from '../../types/state.js';
@@ -645,6 +648,25 @@ export async function runDestroyForStack(
       }
     }
 
+    // Per-resource implicit delete edges that cannot be inferred from a
+    // type-pair rule (e.g. CompositeAlarm -> the metric alarms its AlarmRule
+    // references by name, which carry no Ref / Fn::GetAtt edge). `before` must
+    // be deleted before `after`, so `before` DependsOn `after` (creation order
+    // is reversed for deletion, so `before` is torn down first).
+    for (const { before, after } of computeImplicitDeleteEdges(state.resources)) {
+      const existing = template.Resources[before]?.DependsOn ?? [];
+      const depsArray = Array.isArray(existing) ? existing : [existing];
+      if (!depsArray.includes(after)) {
+        template.Resources[before] = {
+          ...template.Resources[before]!,
+          DependsOn: [...depsArray, after],
+        };
+        logger.debug(
+          `Implicit delete dependency: ${before} (${state.resources[before]?.resourceType}) must be deleted before ${after} (${state.resources[after]?.resourceType})`
+        );
+      }
+    }
+
     const dagBuilder = new DagBuilder();
     const graph = dagBuilder.buildGraph(template);
     const executionLevels = dagBuilder.getExecutionLevels(graph);

src/deployment/deploy-engine.ts

@@ -28,7 +28,10 @@ import type { DagBuilder } from '../analyzer/dag-builder.js';
 import type { DiffCalculator } from '../analyzer/diff-calculator.js';
 import { ProviderRegistry } from '../provisioning/provider-registry.js';
 import { TemplateParser } from '../analyzer/template-parser.js';
-import { IMPLICIT_DELETE_DEPENDENCIES } from '../analyzer/implicit-delete-deps.js';
+import {
+  IMPLICIT_DELETE_DEPENDENCIES,
+  computeImplicitDeleteEdges,
+} from '../analyzer/implicit-delete-deps.js';
 import { withRetry } from './retry.js';
 import { withResourceDeadline } from './resource-deadline.js';
 
@@ -2563,6 +2566,26 @@ export class DeployEngine {
         }
       }
     }
+
+    // Per-resource implicit delete edges that cannot be inferred from a
+    // type-pair rule (e.g. CompositeAlarm -> the metric alarms its AlarmRule
+    // references by name, which carry no Ref / Fn::GetAtt edge).
+    const scoped: Record<string, ResourceState> = {};
+    for (const id of deleteIds) {
+      const resource = state.resources[id];
+      if (resource) scoped[id] = resource;
+    }
+    for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
+      // `before` must be deleted before `after`, so `before` is in `after`'s
+      // deletion deps (picked / deleted first).
+      if (!dependedBy.has(after)) dependedBy.set(after, new Set());
+      if (!dependedBy.get(after)!.has(before)) {
+        dependedBy.get(after)!.add(before);
+        this.logger.debug(
+          `Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`
+        );
+      }
+    }
   }
 
   /**