fix(provisioning): clear SQS attributes removed on UPDATE (Fn::If -> AWS::NoValue) - #850
Merged
Conversation
… UPDATE (Fn::If -> AWS::NoValue) instead of leaving the stale value The new conditions-update-2 integ fixture surfaced a real cdkd UPDATE-path bug: when an SQS Queue property whose value is Fn::If(cond, <value>, AWS::NoValue) flips from <value> (phase a, condition true) to AWS::NoValue (phase b, condition false), the resolved desired properties OMIT the property entirely. cdkd's diff layer correctly classifies that as a change (compareProperties unions current + desired keys, so a key present in state but absent from the resolved template is detected), but SQSQueueProvider.update() only acted on keys PRESENT in the new properties -- so the stale value (e.g. RedrivePolicy) was never cleared on AWS. The fixture's phase-b assertion (WorkQueue RedrivePolicy GONE) failed. This is the "providers only act on keys present in newProperties" gap (feedback_internal_contract_audit_first). The fix adds a removal branch to SQSQueueProvider.update(): a CDK-managed attribute present in previousProperties but absent from the resolved desired properties is reset to its default via SetQueueAttributes, mirroring CloudFormation's reset-to-default-on-removal behavior. The new SQS_ATTRIBUTE_REMOVAL_RESET map clears the JSON policy attributes (RedrivePolicy / RedriveAllowPolicy) and KmsMasterKeyId to the empty string SQS documents for removal, and resets the numeric attributes to their documented SetQueueAttributes defaults. The branch is gated on the attribute being present in previousProperties AND in the reset map, so it never spuriously clears an attribute that was never set (a tag-only update issues no SetQueueAttributes), and immutable / FIFO-discriminated attributes (FifoQueue / DeduplicationScope / FifoThroughputLimit) are deliberately excluded. The change is confined to the SQS provider -- no shared / cross-provider code path changed, so other providers' update semantics are untouched. Unit tests (tests/unit/provisioning/sqs-queue-provider-update.test.ts): clear-on-removal (RedrivePolicy -> ""), numeric-reset-on-removal (VisibilityTimeout -> 30), and the no-over-clear guard (attribute absent on both sides -> no SetQueueAttributes). Also adds the conditions-update-2 integ fixture that stresses the harder CloudFormation-Conditions-on-UPDATE semantics the simple #840 flip does not cover (moved-condition resources, condition-gated outputs, dangling DependsOn on a pruned resource, Ref into a pruned resource, and the Fn::If -> AWS::NoValue property-removal case above). NOTE: needs /run-integ conditions-update-2 against real AWS before merge.
go-to-k
force-pushed
the
test/conditions-update-2
branch
from
June 14, 2026 00:53
aa4fe94 to
1b32fbb
Compare
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 14, 2026
## [0.221.6](v0.221.5...v0.221.6) (2026-06-14) ### Bug Fixes * **provisioning:** clear SQS attributes removed on UPDATE (Fn::If -> AWS::NoValue) ([#850](#850)) ([dd91172](dd91172))
|
🎉 This PR is included in version 0.221.6 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a real cdkd UPDATE bug: a property whose value resolves away via
Fn::If -> AWS::NoValuewas NOT removed from the live AWS resource. Concretely, an SQSRedrivePolicyset on a prior deploy lingered on the queue after a subsequent deploy in which theFn::Ifbranch resolved toAWS::NoValue.Root cause
SQSQueueProvider.update()only acted on keys PRESENT in the desired (new) properties. cdkd's diff layer correctly classifies a property that is present in current state but absent from the desired template as a change, but the provider's update loop never iterated over removed keys, so the stale attribute value was left on AWS.Fix
src/provisioning/providers/sqs-queue-provider.tsadds clear-on-removal: when a CDK-managed attribute was set on a previous deploy (previousProperties[cdkKey] !== undefined) but is absent from the desired properties, it is reset to its documentedSetQueueAttributesdefault (mirroring CloudFormation's reset-removed-property-to-default behavior).RedrivePolicy/RedriveAllowPolicy) andKmsMasterKeyIdare cleared with the empty string the SQS API documents for removal.VisibilityTimeout=30,MaximumMessageSize=262144,MessageRetentionPeriod=345600,DelaySeconds=0,ReceiveMessageWaitTimeSeconds=0,KmsDataKeyReusePeriodSeconds=300).FifoQueue/DeduplicationScope/FifoThroughputLimit) are intentionally excluded from the reset map; the diff/replacement layer handles those separately.Tests
tests/unit/provisioning/sqs-queue-provider-update.test.tscover the removal-reset path.tests/integration/conditions-update-2/deploys an SQS queue with aRedrivePolicybehind anFn::If, then re-deploys with the condition flipped so the policy resolves toAWS::NoValue, asserting the attribute is cleared on AWS.Validation
Validated green against real AWS (the conditions-update-2 integ deploy + update + destroy completed cleanly, RedrivePolicy confirmed removed post-update).