feat(eks): add deletionProtection property to Cluster construct #36474

matoom-nomu · 2025-12-22T08:16:39Z

Issue # (if applicable)

Reason for this change

AWS EKS supports deletion protection to prevent accidental cluster deletion, as documented in the CloudFormation reference.

Description of changes

Add deletionProtection optional property to ClusterProps interface
Update README with usage example

Describe any new or updated permissions being added

None

Description of how you validated changes

Added unit/integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

github-actions · 2025-12-22T08:18:51Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	100 ran	99 passed		1 failed

Test	Result
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-cluster-deletion-protection.js.snapshot/aws-cdk-eks-cluster-deletion-protection.template.json
iam-no-world-accessible-trust-policy.guard	❌ failure

View Security Guardian Results

github-actions · 2025-12-22T08:18:53Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	100 ran	97 passed		3 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-cluster-deletion-protection.js.snapshot/aws-cdk-eks-cluster-deletion-protection.template.json
codepipeline-cross-account-role-trust-scope.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
iam-role-no-broad-principals.guard	❌ failure

View Security Guardian Results with resolved templates

…at/add-deletionProtection-to-ClusterOptions

badmintoncryer

Thank you for your contribution!! I've added some comments.

badmintoncryer · 2025-12-30T06:58:29Z

packages/aws-cdk-lib/aws-eks/test/cluster.test.ts

+  test.each([
+    [true, true],
+    [false, false],
+  ])('deletionProtection(%s) should work', (input, expected) => {
+    // GIVEN
+    const { stack } = testFixture();
+
+    // WHEN
+    new eks.Cluster(stack, 'Cluster', {
+      version: CLUSTER_VERSION,
+      deletionProtection: input,
+      kubectlLayer: new KubectlV31Layer(stack, 'KubectlLayer'),
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('Custom::AWSCDK-EKS-Cluster', {
+      Config: {
+        deletionProtection: expected,
+      },
+    });
+  });


You can describe test conditions more simply.

Suggested change

test.each([

[true, true],

[false, false],

])('deletionProtection(%s) should work', (input, expected) => {

// GIVEN

const { stack } = testFixture();

// WHEN

new eks.Cluster(stack, 'Cluster', {

version: CLUSTER_VERSION,

deletionProtection: input,

kubectlLayer: new KubectlV31Layer(stack, 'KubectlLayer'),

});

// THEN

Template.fromStack(stack).hasResourceProperties('Custom::AWSCDK-EKS-Cluster', {

Config: {

deletionProtection: expected,

},

});

});

test.each([

true, false

])('deletionProtection(%s) should work', (deletionProtection) => {

// GIVEN

const { stack } = testFixture();

// WHEN

new eks.Cluster(stack, 'Cluster', {

version: CLUSTER_VERSION,

deletionProtection,

kubectlLayer: new KubectlV31Layer(stack, 'KubectlLayer'),

});

// THEN

Template.fromStack(stack).hasResourceProperties('Custom::AWSCDK-EKS-Cluster', {

Config: {

deletionProtection,

},

});

});

I've simplified the test descriptions as you suggested.

badmintoncryer · 2025-12-30T06:59:02Z

packages/aws-cdk-lib/aws-eks/test/cluster.test.ts

+    // THEN
+    Template.fromStack(stack).hasResourceProperties('Custom::AWSCDK-EKS-Cluster', {
+      Config: Match.not(Match.objectLike({
+        deletionProtection: Match.anyValue(),


Is it better to use Match.absent()?

You're absolutely right, updated it to use Match.absent().

badmintoncryer · 2025-12-30T07:02:21Z

.../@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-cluster-deletion-protection.ts

+
+new integ.IntegTest(app, 'aws-cdk-eks-cluster-deletion-protection-integ', {
+  testCases: [stack],
+  diffAssets: false,


Because false is the default setting, it may be better to remove this line.

Suggested change

diffAssets: false,

The integ-test file I referenced was using diffAssets: false,
but as you mentioned it's the default setting, so I removed it.
I'll be more careful about checking default values next time.

Have you forgotten to push the modification?

badmintoncryer · 2025-12-30T07:04:59Z

.../@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-cluster-deletion-protection.ts

+  cdkCommandOptions: {
+    deploy: {
+      args: {
+        rollback: true,
+      },
+    },
+  },


Is this condition needed? I think rollback: true is default setting for cdk deploy.

same as above

badmintoncryer · 2025-12-30T07:05:27Z

.../@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-cluster-deletion-protection.ts

+  },
+});
+
+app.synth();


This line is not needed.

Suggested change

app.synth();

badmintoncryer · 2025-12-30T12:41:48Z

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

+   * When true, deletion protection is enabled and the cluster cannot be deleted until protection is disabled.
+   * When false, the cluster can be deleted normally. This setting only applies to clusters in an active state.
+   *
+   * @default - none


Could you please describe the default value or behavior that happens if this property is not supplied?

Suggested change

* @default - none

// default value

* @default false

// default behaviour

* @default - deletion protection is disabled

I fixed comment to use
@default - deletion protection is disabled instead of @default - none

badmintoncryer · 2025-12-30T12:43:32Z

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

+   * The current deletion protection setting for the cluster.
+   * When true, deletion protection is enabled and the cluster cannot be deleted until protection is disabled.
+   * When false, the cluster can be deleted normally. This setting only applies to clusters in an active state.
+   *


Could you please add @see section?

Suggested change

*

*

* @see https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html

*

I added it.

badmintoncryer · 2025-12-30T12:44:30Z

packages/aws-cdk-lib/aws-eks/README.md

Could you please add the link to the documentation?

https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html

I added it.

…at/add-deletionProtection-to-ClusterOptions

badmintoncryer · 2025-12-30T15:37:17Z

Could you please resolve build error?

aws-cdk-lib: /codebuild/output/src3139386751/src/actions-runner/_work/aws-cdk/aws-cdk/packages/aws-cdk-lib/aws-eks/lib/cluster.ts
aws-cdk-lib:   740:5  error  Trailing spaces not allowed  no-trailing-spaces
aws-cdk-lib:   742:5  error  Trailing spaces not allowed  no-trailing-spaces
aws-cdk-lib: /codebuild/output/src3139386751/src/actions-runner/_work/aws-cdk/aws-cdk/packages/aws-cdk-lib/aws-eks/test/cluster.test.ts
aws-cdk-lib:   3968:16  error  Missing trailing comma  @stylistic/comma-dangle

matoom-nomu · 2025-12-31T08:52:12Z

@badmintoncryer

Could you please resolve build error?

aws-cdk-lib: /codebuild/output/src3139386751/src/actions-runner/_work/aws-cdk/aws-cdk/packages/aws-cdk-lib/aws-eks/lib/cluster.ts
aws-cdk-lib:   740:5  error  Trailing spaces not allowed  no-trailing-spaces
aws-cdk-lib:   742:5  error  Trailing spaces not allowed  no-trailing-spaces
aws-cdk-lib: /codebuild/output/src3139386751/src/actions-runner/_work/aws-cdk/aws-cdk/packages/aws-cdk-lib/aws-eks/test/cluster.test.ts
aws-cdk-lib:   3968:16  error  Missing trailing comma  @stylistic/comma-dangle

Sorry for being late, I resoleved those linting errors.
Should i resolve security gurdian checks as well ?

badmintoncryer · 2025-12-31T14:54:13Z

@matoom-nomu Thanks!

Should i resolve security gurdian checks as well ?

It may be not essential. Security guardian CI is introduced experimentally and I think it has no effect to review process.

Could you please address this comment? I'll approve this PR after that.

#36474 (comment)

Have a happy new year!!

…tions

badmintoncryer

Thanks!

matoom-nomu · 2026-01-01T00:36:08Z

@matoom-nomu Thanks!
Could you please address this comment? I'll approve this PR after that.

#36474 (comment)

Have a happy new year!!

Thanks for the review, have a happy new year too!

And it seems there is a build error due to the year change....

@aws-cdk/mixins-preview: - [license/notice-file] NOTICE does NOT begin with AWS Cloud Development Kit (AWS CDK),Copyright 2018-2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.,'

aws-cdk/packages/@aws-cdk/mixins-preview/NOTICE

Line 2 in 2845d47

Shall i make the Issue ticket about this ?

badmintoncryer · 2026-01-01T03:13:54Z

@matoom-nomu This is annual problem. How about submit PR like this?

#32705

add deletionProtection

92ff74f

github-actions bot added feature-request A feature should be added or improved. p2 valued-contributor [Pilot] contributed between 6-12 PRs to the CDK labels Dec 22, 2025

aws-cdk-automation requested a review from a team December 22, 2025 08:16

add unit test case

962037d

pahud mentioned this pull request Dec 22, 2025

Failed CodeBuild CI - 23 PR(s) need attention pahud/aws-cdk#17

Open

matoom-nomu added 2 commits December 22, 2025 22:30

fix linter error

07c4c19

Merge branch 'main' of https://github.com/matoom-nomu/aws-cdk into fe…

55b6b29

…at/add-deletionProtection-to-ClusterOptions

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 22, 2025

matoom-nomu mentioned this pull request Dec 24, 2025

aws-eks: support deletionProtection property #36460

Open

2 tasks

badmintoncryer suggested changes Dec 30, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 30, 2025

matoom-nomu added 2 commits December 31, 2025 00:02

Address PR review comments

3966cb5

Merge branch 'main' of https://github.com/matoom-nomu/aws-cdk into fe…

a40ea03

…at/add-deletionProtection-to-ClusterOptions

solve linter errors

35791a3

matoom-nomu added 2 commits January 1, 2026 08:42

delete diffAssets from IntegTest

2fa5e3b

Merge branch 'aws:main' into feat/add-deletionProtection-to-ClusterOp…

75db431

…tions

badmintoncryer approved these changes Jan 1, 2026

View reviewed changes

github-actions bot mentioned this pull request Jan 1, 2026

Monthly PR metrics report #36544

Open

-   * @default - none
+   // default value
+   * @default false
+   // default behaviour
+   * @default - deletion protection is disabled

-   *
+   *
+   * @see https://docs.aws.amazon.com/eks/latest/userguide/deletion-protection.html
+   *

feat(eks): add deletionProtection property to Cluster construct #36474

Are you sure you want to change the base?

feat(eks): add deletionProtection property to Cluster construct #36474

Conversation

matoom-nomu commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Dec 30, 2025

Uh oh!

matoom-nomu commented Dec 31, 2025

Uh oh!

badmintoncryer commented Dec 31, 2025

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

matoom-nomu commented Jan 1, 2026

Uh oh!

badmintoncryer commented Jan 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

matoom-nomu commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading