cli: a cdk diff with analyticsReporting: false and an empty stack will always print [+] Parameter BootstrapVersion

[rehanvdm]

Describe the bug

When setting analyticsReporting: false on a stack and that has no resources, the diff always reports as if it still wants to add the boostrap ssm param to that stack.

  Stack security--audit--regional--us-east-1 (dlz-regional)
  Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
  Could not create a change set, will base the diff on template differences (run again with -v to see the reason)
  Parameters
  [+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}

  Other Changes
  [+] Unknown Rules: {"CheckBootstrapVersion":{"Assertions":[{"Assert":{"Fn::Not":[{"Fn::Contains":[["1","2","3","4","5"],{"Ref":"BootstrapVersion"}]}]},"AssertDescription":"CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."}]}}

But when you deploy the stack, it won't be created because the deploy commands knows that the stack has no resources and it won't add the version ssm param.

security--log--regional--us-east-1 (dlz-regional)
security--log--regional--us-east-1 (dlz-regional): stack has no resources, skipping deployment.

The logic of skipping a stack deployment must be applied to the diff the same as it is being applied to the deploy command

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

The logic of skipping a stack deployment must be applied to the diff the same as it is being applied to the deploy command

Current Behavior

The logic for the diff and deploy commands differ

Reproduction Steps

1. Create an empty stack, specify the analyticsReporting: false option.
2. Do a diff and a deploy compare the results

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.133.0

Framework Version

No response

Node.js Version

OS

Language

TypeScript

Language Version

No response

Other information

No response

[khushail]

Hi @rehanvdm , thanks for reporting this.

The issue is reproducible with the following code -

const app = new cdk.App();
new CliIssueStack(app, 'CliIssueStack', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
  analyticsReporting: false,  
  });

when cdk diff was run, got the diff result as -

however deployment succeeded as you stated -

AFAIU, cdk v2 uses defaultStackSynthesizer, which adds following json code into each synthesized template by default -

{
 "Parameters": {
  "BootstrapVersion": {
   "Type": "AWS::SSM::Parameter::Value<String>",
   "Default": "/cdk-bootstrap/hnb659fds/version",
   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
  }
 },
 "Rules": {
  "CheckBootstrapVersion": {
   "Assertions": [
    {
     "Assert": {
      "Fn::Not": [
       {
        "Fn::Contains": [
         [
          "1",
          "2",
          "3",
          "4",
          "5"
         ],
         {
          "Ref": "BootstrapVersion"
         }
        ]
       }
      ]
     },
     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
    }
   ]
  }
 }
}

CDK uses this rule to check the version of the Bootstrap stack which is deployed in your environment. However it can be removed by setting generateBootstrapVersionRule :false and that would not add the skip statement as you can see below -

const app = new cdk.App();
new CliIssueStack(app, 'CliIssueStack', {
  synthesizer: new DefaultStackSynthesizer({
    generateBootstrapVersionRule: false
  })
})

synthesized template -

{
 "Resources": {
  "CDKMetadata": {
   "Type": "AWS::CDK::Metadata",
   "Properties": {
    "Analytics": "v2:deflate64:H4sIAAAAAAAA/zPSMzQz0jNUTCwv1k1OydbNyUzSqw4uSUzO1nFOywtKLc4vLUpOBbGd8/NSMksy8/NqdfLyU1L1sor1y4wM9AzN9QwUs4ozM3WLSvNKMnNT9YIgNADO/LHuWgAAAA=="
   },
   "Metadata": {
    "aws:cdk:path": "CliIssueStack/CDKMetadata/Default"
   },
   "Condition": "CDKMetadataAvailable"
  }
 },
 "Conditions": {
  "CDKMetadataAvailable": {
   "Fn::Or": [
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "af-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-northeast-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-northeast-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-northeast-3"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-south-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-3"
       ]
      }
     ]
    },
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ap-southeast-4"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ca-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "ca-west-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "cn-north-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "cn-northwest-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-central-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-north-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-south-2"
       ]
      }
     ]
    },
    {
     "Fn::Or": [
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "eu-west-3"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "il-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "me-central-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "me-south-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "sa-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-east-1"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-east-2"
       ]
      },
      {
       "Fn::Equals": [
        {
         "Ref": "AWS::Region"
        },
        "us-west-1"
       ]
      }
     ]
    },
    {
     "Fn::Equals": [
      {
       "Ref": "AWS::Region"
      },
      "us-west-2"
     ]
    }
   ]
  }
 }
}

and synth does not show any such message.

More information about generateBootstrapVersionRule -

aws-cdk/packages/aws-cdk-lib/core/lib/stack-synthesizers/default-synthesizer.ts

Line 195 in cb3ecfe

readonly generateBootstrapVersionRule?: boolean;

  /**
   * Whether to add a Rule to the stack template verifying the bootstrap stack version
   *
   * This generally should be left set to `true`, unless you explicitly
   * want to be able to deploy to an unbootstrapped environment.
   *
   * @default true
   */
  readonly generateBootstrapVersionRule?: boolean;

and how this flag value is used during synthesis -

aws-cdk/packages/aws-cdk-lib/core/lib/stack-synthesizers/default-synthesizer.ts

Line 489 in cb3ecfe

if (this.props.generateBootstrapVersionRule ?? true) {

I am not really sure if team would want to change that check of bootstrap version

Reaching out to team for further inputs and requesting to share insights on this issue.

[rehanvdm]

@khushail what would be the consequence of setting generateBootstrapVersionRule false? I don't want to mess with the CDK internals/logic?

[khushail]

@rehanvdm , this is what I see is mentioned on CDK Docs -
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.DefaultStackSynthesizerProps.html#generatebootstrapversionrule

generateBootstrapVersionRule?

Type: boolean (optional, default: true)

Whether to add a Rule to the stack template verifying the bootstrap stack version.

This generally should be left set to true, unless you explicitly want to be able to deploy to an unbootstrapped environment.

which would mean if this is false, one has to provide a custom bucket, custom role and ECR for the default synthesis process as once you bootstrap any region/environment, default resources are created for the CDK Synthesis process.

For further reference on how to provide your own resources when env is not bootstrapped -https://bliskavka.com/2022/02/07/synth-cdk-to-custom-bucket/

hope this would be helpful!

[HBobertz]

CDK Core Team Member checking in.

Great catch, we definitely don't want to mess with the actual check logic for the bootstrap version but the diff logic should be properly outputting that we wouldn't be creating this SSM parameter in an empty stack. Still a P2 bug in the backlog, thanks for the report