fix(deployment): resolve CompositeAlarm/EC2 GetAtt attributes + CompositeAlarm delete ordering - #851
Merged
Merged
Conversation
…positeAlarm-before-Alarm delete ordering Resolve Fn::GetAtt for AWS::CloudWatch::CompositeAlarm Arn and AWS::EC2::Instance IP/DNS attributes in constructAttribute, so deep GetAtt chains across these types materialize correctly during deployment. Add an implicit delete dependency so an AWS::CloudWatch::CompositeAlarm is deleted before the metric Alarms its AlarmRule references, avoiding a dangling-rule failure on destroy. Add the deep-getatt-chains integration fixture exercising these GetAtt chains and the CompositeAlarm/Alarm delete ordering end-to-end.
go-to-k
force-pushed
the
test/deep-getatt-chains
branch
from
June 14, 2026 01:37
f434fac to
c6ca623
Compare
Owner
Author
|
Independent code review complete (pr-code-reviewer): both fixes clean, no blockers. CompositeAlarm ARN shape correct; EC2 live-lookup bounded+cached+falls-back; AlarmRule parsing handles bare/quoted/ARN + ignores TRUE/FALSE + self-edge-guarded; delete-edge wired into BOTH deploy-engine and destroy-runner with correct direction. No regressions (purely additive constructAttribute cases). 2 minor nits accepted: duplicate-alarm-name last-wins (AWS names are unique, harmless) + absent-attr physicalId fallback (narrow acceptable case). Plus unit tests + real-AWS integ PASS. Setting pr-review bound to c6ca623. |
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 14, 2026
## [0.221.9](v0.221.8...v0.221.9) (2026-06-14) ### Bug Fixes * **deployment:** resolve CompositeAlarm/EC2 GetAtt attributes + CompositeAlarm delete ordering ([#851](#851)) ([da5d976](da5d976))
|
🎉 This PR is included in version 0.221.9 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two real cdkd bugs surfaced by deep
Fn::GetAttcomputed-attribute chains, plus adds the failure-seekingdeep-getatt-chainsinteg fixture and unit tests.Bug 1: Fn::GetAtt returned the physicalId for several computed attributes
The intrinsic-function resolver fell through to returning the resource's
physicalIdfor attributes it had no per-type case for, silently producing wrong values:AWS::CloudWatch::CompositeAlarmArn-- now constructs thearn:<partition>:cloudwatch:<region>:<account>:alarm:<name>ARN instead of returning the alarm name (physicalId).AWS::EC2::InstancePrivateIp/PublicIp/PrivateDnsName/PublicDnsName/AvailabilityZone-- now resolved via a liveDescribeInstancescall instead of returning the instance id (physicalId).Files:
src/deployment/intrinsic-function-resolver.ts,src/deployment/deploy-engine.ts.Bug 2: CompositeAlarm deleted after the metric Alarms it references
A
CompositeAlarm'sAlarmRulenames its child metric Alarms as plain strings (noRef/Fn::GetAtt), so the analyzer built no dependency edge and could delete the child Alarms before the CompositeAlarm. AWS rejects deleting an Alarm still referenced by a CompositeAlarm's rule.Added an implicit delete-ordering rule so a
CompositeAlarmis deleted BEFORE the metric Alarms itsAlarmRulereferences (parsed out of the rule string).Files:
src/analyzer/implicit-delete-deps.ts,src/deployment/deploy-engine.ts,src/cli/commands/destroy-runner.ts.Tests
tests/integration/deep-getatt-chains/exercises long computed-attribute chains through CompositeAlarm and EC2 Instance.tests/unit/deployment/intrinsic-functions.test.ts,tests/unit/analyzer/implicit-delete-deps.test.ts).Verification
Validated end-to-end (deploy + destroy clean, 0 orphans) against real AWS on this branch.
Note
The EC2
PrivateIpGetAtt fix in this PR is also required by the upcomingdeletion-ordering-complexfixture; merging this PR first lands that fix on main.