Skip to content

Commit 6e400a9

Browse files
daschaadaschaa
authored
feat(dynamodb): adds deletion protection for tables (#24581)
You can enable deletion protection for a table by setting the `deletionProtection` property to `true`. When deletion protection is enabled for a table, it cannot be deleted by anyone. By default, deletion protection is disabled. Closes #24540 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent cf5a9c4 commit 6e400a9

12 files changed

+547
-0
lines changed

Diff for: ‎packages/@aws-cdk/aws-dynamodb/README.md

+12
Original file line numberDiff line numberDiff line change
@@ -236,3 +236,15 @@ new cloudwatch.Alarm(stack, 'Alarm', {
236236
threshold: 1,
237237
});
238238
```
239+
240+
## Deletion Protection for Tables
241+
242+
You can enable deletion protection for a table by setting the `deletionProtection` property to `true`.
243+
When deletion protection is enabled for a table, it cannot be deleted by anyone. By default, deletion protection is disabled.
244+
245+
```ts
246+
const table = new dynamodb.Table(this, 'Table', {
247+
partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING },
248+
deletionProtection: true,
249+
});
250+
```

Diff for: ‎packages/@aws-cdk/aws-dynamodb/lib/table.ts

+8
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,13 @@ export interface TableOptions extends SchemaOptions {
291291
* @default false
292292
*/
293293
readonly contributorInsightsEnabled?: boolean;
294+
295+
/**
296+
* Enables deletion protection for the table.
297+
*
298+
* @default false
299+
*/
300+
readonly deletionProtection?: boolean;
294301
}
295302

296303
/**
@@ -1238,6 +1245,7 @@ export class Table extends TableBase {
12381245
timeToLiveSpecification: props.timeToLiveAttribute ? { attributeName: props.timeToLiveAttribute, enabled: true } : undefined,
12391246
contributorInsightsSpecification: props.contributorInsightsEnabled !== undefined ? { enabled: props.contributorInsightsEnabled } : undefined,
12401247
kinesisStreamSpecification: props.kinesisStream ? { streamArn: props.kinesisStream.streamArn } : undefined,
1248+
deletionProtectionEnabled: props.deletionProtection,
12411249
});
12421250
this.table.applyRemovalPolicy(props.removalPolicy);
12431251

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/dynamodb.test.ts

+43
Original file line numberDiff line numberDiff line change
@@ -3194,3 +3194,46 @@ function testGrant(expectedActions: string[], invocation: (user: iam.IPrincipal,
31943194
],
31953195
});
31963196
}
3197+
3198+
describe('deletionProtectionEnabled', () => {
3199+
test.each([
3200+
[true],
3201+
[false],
3202+
])('gets passed to table', (state) => {
3203+
// GIVEN
3204+
const stack = new Stack();
3205+
3206+
// WHEN
3207+
new Table(stack, 'Table', {
3208+
partitionKey: {
3209+
name: 'id',
3210+
type: AttributeType.STRING,
3211+
},
3212+
deletionProtection: state,
3213+
});
3214+
3215+
// THEN
3216+
Template.fromStack(stack).hasResourceProperties('AWS::DynamoDB::Table', {
3217+
DeletionProtectionEnabled: state,
3218+
});
3219+
});
3220+
3221+
test('is not passed when not set', () => {
3222+
// GIVEN
3223+
const stack = new Stack();
3224+
3225+
// WHEN
3226+
new Table(stack, 'Table', {
3227+
partitionKey: {
3228+
name: 'id',
3229+
type: AttributeType.STRING,
3230+
},
3231+
});
3232+
3233+
// THEN
3234+
Template.fromStack(stack).hasResourceProperties('AWS::DynamoDB::Table', Match.objectLike({
3235+
DeletionProtectionEnabled: Match.absent(),
3236+
}));
3237+
});
3238+
});
3239+

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/deletion-protection-stack.assets.json

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"f87ba4fca1a1119dcfae7e01fe3db2422f42d132352c5519b5ca76cb608f74d3": {
5+
"source": {
6+
"path": "deletion-protection-stack.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"889855614607-us-east-1": {
11+
"bucketName": "cdk-hnb659fds-assets-889855614607-us-east-1",
12+
"objectKey": "f87ba4fca1a1119dcfae7e01fe3db2422f42d132352c5519b5ca76cb608f74d3.json",
13+
"region": "us-east-1",
14+
"assumeRoleArn": "arn:${AWS::Partition}:iam::889855614607:role/cdk-hnb659fds-file-publishing-role-889855614607-us-east-1"
15+
}
16+
}
17+
}
18+
},
19+
"dockerImages": {}
20+
}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/deletion-protection-stack.template.json

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"Resources": {
3+
"TableCD117FA1": {
4+
"Type": "AWS::DynamoDB::Table",
5+
"Properties": {
6+
"KeySchema": [
7+
{
8+
"AttributeName": "pk",
9+
"KeyType": "HASH"
10+
}
11+
],
12+
"AttributeDefinitions": [
13+
{
14+
"AttributeName": "pk",
15+
"AttributeType": "S"
16+
}
17+
],
18+
"DeletionProtectionEnabled": true,
19+
"ProvisionedThroughput": {
20+
"ReadCapacityUnits": 5,
21+
"WriteCapacityUnits": 5
22+
},
23+
"TableName": "deletion-protection-test"
24+
},
25+
"UpdateReplacePolicy": "Delete",
26+
"DeletionPolicy": "Delete"
27+
}
28+
},
29+
"Parameters": {
30+
"BootstrapVersion": {
31+
"Type": "AWS::SSM::Parameter::Value<String>",
32+
"Default": "/cdk-bootstrap/hnb659fds/version",
33+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
34+
}
35+
},
36+
"Rules": {
37+
"CheckBootstrapVersion": {
38+
"Assertions": [
39+
{
40+
"Assert": {
41+
"Fn::Not": [
42+
{
43+
"Fn::Contains": [
44+
[
45+
"1",
46+
"2",
47+
"3",
48+
"4",
49+
"5"
50+
],
51+
{
52+
"Ref": "BootstrapVersion"
53+
}
54+
]
55+
}
56+
]
57+
},
58+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
59+
}
60+
]
61+
}
62+
}
63+
}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/deletionprotectionintegtestDefaultTestDeployAssertA66823A5.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "deletionprotectionintegtestDefaultTestDeployAssertA66823A5.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/deletionprotectionintegtestDefaultTestDeployAssertA66823A5.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/integ.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"deletion-protection-integ-test/DefaultTest": {
5+
"stacks": [
6+
"deletion-protection-stack"
7+
],
8+
"hooks": {
9+
"postDeploy": [
10+
"aws dynamodb update-table --no-cli-pager --region us-east-1 --table-name deletion-protection-test --no-deletion-protection-enabled"
11+
]
12+
},
13+
"regions": [
14+
"us-east-1"
15+
],
16+
"cdkCommandOptions": {
17+
"deploy": {
18+
"args": {
19+
"rollback": true
20+
}
21+
}
22+
},
23+
"assertionStack": "deletion-protection-integ-test/DefaultTest/DeployAssert",
24+
"assertionStackName": "deletionprotectionintegtestDefaultTestDeployAssertA66823A5"
25+
}
26+
}
27+
}

Diff for: ‎packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.deletion-protection.js.snapshot/manifest.json

+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"version": "31.0.0",
3+
"artifacts": {
4+
"deletion-protection-stack.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "deletion-protection-stack.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"deletion-protection-stack": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://889855614607/us-east-1",
15+
"properties": {
16+
"templateFile": "deletion-protection-stack.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::889855614607:role/cdk-hnb659fds-deploy-role-889855614607-us-east-1",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::889855614607:role/cdk-hnb659fds-cfn-exec-role-889855614607-us-east-1",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-889855614607-us-east-1/f87ba4fca1a1119dcfae7e01fe3db2422f42d132352c5519b5ca76cb608f74d3.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"deletion-protection-stack.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::889855614607:role/cdk-hnb659fds-lookup-role-889855614607-us-east-1",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"deletion-protection-stack.assets"
34+
],
35+
"metadata": {
36+
"/deletion-protection-stack/Table": [
37+
{
38+
"type": "aws:cdk:hasPhysicalName",
39+
"data": {
40+
"Ref": "TableCD117FA1"
41+
}
42+
}
43+
],
44+
"/deletion-protection-stack/Table/Resource": [
45+
{
46+
"type": "aws:cdk:logicalId",
47+
"data": "TableCD117FA1",
48+
"trace": [
49+
"!!DESTRUCTIVE_CHANGES: WILL_REPLACE"
50+
]
51+
}
52+
],
53+
"/deletion-protection-stack/BootstrapVersion": [
54+
{
55+
"type": "aws:cdk:logicalId",
56+
"data": "BootstrapVersion"
57+
}
58+
],
59+
"/deletion-protection-stack/CheckBootstrapVersion": [
60+
{
61+
"type": "aws:cdk:logicalId",
62+
"data": "CheckBootstrapVersion"
63+
}
64+
]
65+
},
66+
"displayName": "deletion-protection-stack"
67+
},
68+
"deletionprotectionintegtestDefaultTestDeployAssertA66823A5.assets": {
69+
"type": "cdk:asset-manifest",
70+
"properties": {
71+
"file": "deletionprotectionintegtestDefaultTestDeployAssertA66823A5.assets.json",
72+
"requiresBootstrapStackVersion": 6,
73+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
74+
}
75+
},
76+
"deletionprotectionintegtestDefaultTestDeployAssertA66823A5": {
77+
"type": "aws:cloudformation:stack",
78+
"environment": "aws://unknown-account/unknown-region",
79+
"properties": {
80+
"templateFile": "deletionprotectionintegtestDefaultTestDeployAssertA66823A5.template.json",
81+
"validateOnSynth": false,
82+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
83+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
84+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
85+
"requiresBootstrapStackVersion": 6,
86+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
87+
"additionalDependencies": [
88+
"deletionprotectionintegtestDefaultTestDeployAssertA66823A5.assets"
89+
],
90+
"lookupRole": {
91+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
92+
"requiresBootstrapStackVersion": 8,
93+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
94+
}
95+
},
96+
"dependencies": [
97+
"deletionprotectionintegtestDefaultTestDeployAssertA66823A5.assets"
98+
],
99+
"metadata": {
100+
"/deletion-protection-integ-test/DefaultTest/DeployAssert/BootstrapVersion": [
101+
{
102+
"type": "aws:cdk:logicalId",
103+
"data": "BootstrapVersion"
104+
}
105+
],
106+
"/deletion-protection-integ-test/DefaultTest/DeployAssert/CheckBootstrapVersion": [
107+
{
108+
"type": "aws:cdk:logicalId",
109+
"data": "CheckBootstrapVersion"
110+
}
111+
]
112+
},
113+
"displayName": "deletion-protection-integ-test/DefaultTest/DeployAssert"
114+
},
115+
"Tree": {
116+
"type": "cdk:tree",
117+
"properties": {
118+
"file": "tree.json"
119+
}
120+
}
121+
}
122+
}

0 commit comments

Comments
 (0)