Add termination-protection? opt to cfn stack

Author: john-shaffer

CHANGELOG.md

@@ -6,6 +6,8 @@
   They would previously return nil for these responses.
 - Add `salmon.cleanup/full-delete-all-stacks!` for deleting
   resources in test accounts
+- Add `:termination-protection?` option to `salmon.cloudformation/stack`.
+  This can be used to enable or disable termination protection.  
 
 ## v0.20.0 (2024-12-12)
 

src/salmon/cloudformation.clj

@@ -198,23 +198,35 @@
 (defn- cou-stack!
   "Create a new stack or update an existing one with the same name."
   [client {::ds/keys [config]} template-json]
-  (let [{:keys [capabilities name parameters tags]} config
+  (let [{:keys [capabilities name parameters tags termination-protection?]} config
         request {:Capabilities (seq capabilities)
+                 :EnableTerminationProtection (boolean termination-protection?)
                  :Parameters (aws-parameters parameters)
                  :StackName name
                  :Tags (u/tags tags)
                  :TemplateBody template-json}
         r (aws/invoke client {:op :DescribeStacks
                               :request {:StackName name}})
-        {:keys [StackId StackStatus]} (some-> r :Stacks first)]
+        [{:keys [EnableTerminationProtection StackId StackStatus]}]
+        #__ (:Stacks r)]
     (cond
       (= "ROLLBACK_COMPLETE" StackStatus)
       #__ (do
             (delete-stack! client StackId)
             (create-stack! client request))
       (= "ValidationError" (u/aws-error-code r)) (create-stack! client request)
       (u/anomaly? r) [r false]
-      :else (update-stack! client request StackId))))
+
+      :else
+      (do
+        (when (and (not (nil? termination-protection?))
+                (not= EnableTerminationProtection (boolean termination-protection?)))
+          (u/invoke! client
+            {:op :UpdateTerminationProtection
+             :request
+             {:EnableTerminationProtection (boolean termination-protection?)
+              :StackName StackId}}))
+        (update-stack! client request StackId)))))
 
 (defn- outputs-map-raw [outputs-seq]
   (reduce
@@ -358,7 +370,12 @@
 
    :template
    A map representing a CloudFormation template. The map
-   may contain donut.system refs."
+   may contain donut.system refs.
+
+   :termination-protection?
+   Enables or disables termination protection on the stack.
+   Ignored when nil.
+   Default: nil."
   [& {:as config}]
   {::ds/config config
    ::ds/start start-stack!

test/salmon/cloudformation_test.clj

@@ -338,6 +338,68 @@
         "Outputs are correct")
       (ds/signal sys :salmon/delete))))
 
+(deftest test-termination-protection
+  (let [{:keys [regions]} (test/get-config)
+        stack-name (test/rand-stack-name)]
+    (doseq [region regions
+            :let [stack-tp (stack-a :lint? true
+                             :name stack-name
+                             :region region
+                             :template template-a
+                             :termination-protection? true)
+                  stack-no-tp (stack-a :lint? true
+                                :name stack-name
+                                :region region
+                                :template template-a
+                                :termination-protection? false)
+                  stack-tp-unset (stack-a :lint? true
+                                   :name stack-name
+                                   :region region
+                                   :template template-a
+                                   :termination-protection? nil)
+                  system-def (system-a stack-tp)]]
+      (test/with-system-delete [system system-def]
+        (testing "termination-protection? prevents deletion"
+          (is (thrown-with-msg?
+                ExceptionInfo
+                #"TerminationProtection is enabled"
+                (cause (ds/signal @system :salmon/delete)))))
+        (testing "nil termination-protection? leaves existing setting"
+          (reset! system (ds/start (system-a stack-tp-unset)))
+          (is (thrown-with-msg?
+                ExceptionInfo
+                #"TerminationProtection is enabled"
+                (cause (ds/signal @system :salmon/delete)))))
+        (testing "delete works after disabling termination-protection?"
+          (reset! system (ds/start (system-a stack-no-tp)))
+          (let [stack-id (-> @system ::ds/instances :services :stack-a :stack-id)]
+            (reset! system (ds/signal @system :salmon/delete))
+            (is (= {:name stack-name :stack-id stack-id}
+                  (-> @system ::ds/instances :services :stack-a)))))
+        ; Re-create stack with no termination protection
+        (reset! system (ds/start (system-a stack-no-tp)))
+        (testing "termination-protection? can be enabled for pre-existing stacks"
+          (reset! system (ds/start (system-a stack-tp)))
+          (is (thrown-with-msg?
+                ExceptionInfo
+                #"TerminationProtection is enabled"
+                (cause (ds/signal @system :salmon/delete)))))
+        (testing "termination-protection? can be disabled and enabled again"
+          (reset! system (ds/start (system-a stack-no-tp)))
+          (reset! system (ds/start (system-a stack-tp)))
+          (is (thrown-with-msg?
+                ExceptionInfo
+                #"TerminationProtection is enabled"
+                (cause (ds/signal @system :salmon/delete)))))
+        (testing "delete works after disabling termination-protection?"
+          (reset! system (ds/start (system-a stack-no-tp)))
+          (testing "nil termination-protection? leaves existing setting"
+            (reset! system (ds/start (system-a stack-tp-unset)))
+            (let [stack-id (-> @system ::ds/instances :services :stack-a :stack-id)]
+              (reset! system (ds/signal @system :salmon/delete))
+              (is (= {:name stack-name :stack-id stack-id}
+                    (-> @system ::ds/instances :services :stack-a))))))))))
+
 (deftest test-describe-stack-raw
   (let [stack-name (test/rand-stack-name)
         sys (ds/start (system-a (stack-a :capabilities #{"CAPABILITY_NAMED_IAM"} :name stack-name :template template-a)))]