cdk deploy prints a link to the closed aws-cdk/issues/1299

[marcindulak]

Certain cdk deploy commands print the following message "NOTE: There may be security-related changes not in this list. See #1299".

Note that this issue is closed, but no sufficient clarification has been provided whether the problem with resources that are created but not reported in the cdk output is still present.

Reproduction Steps

Not relevant

Error Log

Environment

• CLI Version : 1.36.0 (build 47c9919)
• Framework Version: 1.36.0
• OS : Ubuntu 18.04.4 LTS
• Language : typescript

Other

---

This is 🐛 Bug Report

[shivlaks]

hey @marcindulak - the issue has been re-titled to be an RFC as we encourage any comments and feedback related to the coverage cdk diff provides

Although it's closed, the conversation is not locked. If you have an example of something that's not being covered, feel free to add to that thread and re-open. The link is still present as we'd like to aggregate any additional feedback there and reopen the issue as needed.

Users of the CLI would still be able to go there and check in on the current state of that issue.

I do think it's actionable for us to better document what the CDK scrutiny report covers.

[marcindulak]

Could you add an appropriate explanation (at the bottom) to #1299? It's unclear what is its purpose after several off-topic comments present in that issue, and calling it RFC does not provide any extra information.

[shivlaks]

@marcindulak is there something the summary is not capturing?

should I include the following snippet again in the comments?

Please use this GitHub issue to let us know how this feature is working out for you. Is the diff correct? Is CDK identifying the right changes? Anything else you'd like to tell us?

Is there anything else you'd like to see here?

[marcindulak]

Maybe also include the comment you made

Although the issue is closed, the conversation is not locked.

There is also the question #1299 (comment), which requires a clarification. We are told that some changes are possibly not included in the diff, but why is it so?

[shivlaks]

@marcindulak fair point, i'll update! thanks for taking the time to provide feedback.