RestApiCloudWatchRole is not cleaned up with aws-cdk >= 2.38.0

[luismeyer]

Since Version 2.38.0 AWS cdk adds the RemovalPolicy "Retain" to the CloudwatchRole which is created automatically for RestApi's. This results in the CloudWatchRole leaking after the Stack was deleted. Therefor more and more IAM Roles are added in our AWS.

The issue was that the RestAPI CloudWatchRole was overwriting the AccountLevel Role for RestAPI's.

Reading from the ApiGateway Doc's, i think aws-simple shouldn't create a new Log Role for every Stack
Note: there can only be a single apigateway.CfnAccount per AWS environment so if you create multiple RestApis with cloudWatchRole=true each new RestApi will overwrite the CfnAccount. It is recommended to set cloudWatchRole=false (the default behavior if @aws-cdk/aws-apigateway:disableCloudWatchRole is enabled) and only create a single CloudWatch role and account per environment.

A solution would be enabling the FeatureFlag @aws-cdk/aws-apigateway:disableCloudWatchRole to prevent the creation of the CloudWatch role by default.

new App({
    context: {
        '@aws-cdk/aws-apigateway:disableCloudWatchRole': true,
    },
})

[clebert]

Hello Luis,

Thank you for your detailed description of the issue. We have decided to keep the current behavior. But to address the issue there is now a new helper command aws-simple cleanup to delete REST-API CloudWatch roles that are no longer associated with a stack.

I hope this works for you.

Please see => 7c43379