How to Keep AI from Breaking Your Environment with AWS CDK

Описание и применение

Разработчики, использующие ИИ для генерации кода AWS CDK, рискуют случайно удалить или заменить критические ресурсы. Новые флаги --fail-on destructive и --require-approval destructive позволяют автоматически обнаруживать разрушительные изменения и требовать ручного подтверждения, тем самым защищая инфраструктуру.

Задача

AI-generated CDK code can unintentionally delete or replace critical resources, causing downtime or data loss.

Результат

By using --fail-on destructive and --require-approval destructive, developers can safely let AI drive CDK development while preventing accidental destructive changes.

Рабочий процесс

• Run cdk diff --fail-on destructive to detect destructive changes.
• If destructive changes are found, the command exits with an error and lists the affected resources.
• In CI/CD, insert this step before deployment to block destructive changes automatically.
• If the change is intentional, manually approve and continue with cdk deploy or cdk deploy --require-approval destructive.
• If not intentional, abort or revert the change.

Доказательства

Running cdk diff with destructive passed to --fail-on makes it exit with an error only when there are destructive changes such as resource deletions or replacements.

Источник

cdk deploy --require-approval destructive lets you detect destructive changes and prompt for confirmation.

Источник

With this in place, the process stops only on destructive changes inside an autonomous, automated loop, which gives you a workflow that ensures safety at a low cost.

Источник