How to Keep AI from Breaking Your Environment with AWS CDK

Description and use

Developers using AI to generate AWS CDK code risk unintentionally deleting or replacing critical resources. The new --fail-on destructive and --require-approval destructive flags enable automatic detection of destructive changes and require manual approval, safeguarding the infrastructure.

Problem

AI-generated CDK code can unintentionally delete or replace critical resources, causing downtime or data loss.

Outcome

By using --fail-on destructive and --require-approval destructive, developers can safely let AI drive CDK development while preventing accidental destructive changes.

Workflow

• Run cdk diff --fail-on destructive to detect destructive changes.
• If destructive changes are found, the command exits with an error and lists the affected resources.
• In CI/CD, insert this step before deployment to block destructive changes automatically.
• If the change is intentional, manually approve and continue with cdk deploy or cdk deploy --require-approval destructive.
• If not intentional, abort or revert the change.

Evidence

Running cdk diff with destructive passed to --fail-on makes it exit with an error only when there are destructive changes such as resource deletions or replacements.

Source

cdk deploy --require-approval destructive lets you detect destructive changes and prompt for confirmation.

Source

With this in place, the process stops only on destructive changes inside an autonomous, automated loop, which gives you a workflow that ensures safety at a low cost.

Source