How to Keep AI from Breaking Your Environment with AWS CDK

说明与用途

使用 AI 生成 AWS CDK 代码的开发者可能无意中删除或替换关键资源。新的 --fail-on destructive 和 --require-approval destructive 标志可自动检测破坏性更改并要求人工批准，从而保护基础设施。

问题

AI-generated CDK code can unintentionally delete or replace critical resources, causing downtime or data loss.

结果

By using --fail-on destructive and --require-approval destructive, developers can safely let AI drive CDK development while preventing accidental destructive changes.

工作流

• Run cdk diff --fail-on destructive to detect destructive changes.
• If destructive changes are found, the command exits with an error and lists the affected resources.
• In CI/CD, insert this step before deployment to block destructive changes automatically.
• If the change is intentional, manually approve and continue with cdk deploy or cdk deploy --require-approval destructive.
• If not intentional, abort or revert the change.

证据

Running cdk diff with destructive passed to --fail-on makes it exit with an error only when there are destructive changes such as resource deletions or replacements.

来源

cdk deploy --require-approval destructive lets you detect destructive changes and prompt for confirmation.

来源

With this in place, the process stops only on destructive changes inside an autonomous, automated loop, which gives you a workflow that ensures safety at a low cost.

来源