AWS::Serverless transform creating resources that fail W3011 (DeletionPolicy/UpdateReplacePolicy rule)

[TLaue]

cfn-lint version: (cfn-lint --version)
0.26.01

Description of issue.
The latest version of cfn-lint creates a warning in case of missing Deletion and UpdateReplace policy. This complain appears even though both properties are set for an S3 bucket which is the only resource in our stack wich requires these properties according to #1232. This warning did not appear prior to version 0.26.1. What is the difference beween I3011 and W3011?

Resources:
  xxxBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:...

[PatMyron]

What is the difference beween I3011 and W3011?

W3011 warns about any resource that is protected from deletion through either an UpdateReplacePolicy or a DeletionPolicy but not protected by both

I3011 informs about any resource missing UpdateReplacePolicy / DeletionPolicy that could potentially result in data loss based on its resource type:

cfn-lint/src/cfnlint/rules/resources/UpdateReplacePolicyDeletionPolicyOnStatefulResourceTypes.py

Lines 22 to 39 in c3d1645

	likely_stateful_resource_types = ['AWS::CloudFormation::Stack',
	'AWS::Backup::BackupVault',
	'AWS::DocDB::DBCluster',
	'AWS::DocDB::DBInstance',
	'AWS::DynamoDB::Table',
	'AWS::EC2::Volume',
	'AWS::EFS::FileSystem',
	'AWS::EMR::Cluster',
	'AWS::ElastiCache::CacheCluster',
	'AWS::ElastiCache::ReplicationGroup',
	'AWS::FSx::FileSystem',
	'AWS::Neptune::DBCluster',
	'AWS::Neptune::DBInstance',
	'AWS::QLDB::Ledger',
	'AWS::RDS::DBCluster',
	'AWS::RDS::DBInstance',
	'AWS::Redshift::Cluster',
	'AWS::SDB::Domain',

---

@TLaue are you comfortable sharing the template that is generating the warning? I wasn't able to produce output with either of these templates:

Resources:
  Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete

Resources:
  Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName: bucket

---

@TLaue @kddejong some of the confusion might be coming from the 3011 messages lacking the resource logical ID that other rules provide. I can add that. In the meantime, rules give the line number of the violation and the Visual Studio Code extension should show them in context

[TLaue]

May I send the template via email to you? Can you provide an email address?

[TLaue]

It is on the way.

[PatMyron]

@TLaue I believe the AWS::Serverless transform is creating AWS::Lambda::Version resources with DeletionPolicy: Retain but no UpdateReplacePolicy. Will reach out to them about that

[senior88oqz]

AWS::Lambda::Version

In my template, I've got Transform: AWS::Serverless-2016-10-31 and AutoPublishAlias: live property in my AWS::Serverless::Function, and it fails to pass the updated W3011. I believe it's the AWS::Lambda::Version causing the problem, as if I comment out AutoPublishAlias: live, W3011 passes.

[PatMyron]

#1266 should make what's happening clearer

@keetonian @praneetap any thoughts on which UpdateReplacePolicy to set on those resources?

https://github.com/awslabs/serverless-application-model/blob/a9388b64147e12426ba585482ee96f81db2dd25a/samtranslator/model/sam_resources.py#L415
https://github.com/awslabs/serverless-application-model/blob/a9388b64147e12426ba585482ee96f81db2dd25a/samtranslator/model/sam_resources.py#L794

[forzagreen]

A workaround:

cfn-lint --ignore-checks W3011 -t template.yml

The error is because SAM creates resources of type AWS::Lambda::Version for each lambda function.
This Version resource has a default property "DeletionPolicy": "Retain" , but they don't have UpdateReplacePolicy property.
To see the full resources after transformation run cfn-lint with --info.

[hugoduraes]

@PatMyron any news on this?

[PatMyron]

The explicit UpdateReplacePolicy changes have been merged into AWS::Serverless transform's develop branch, but still haven't made it into a release yet. Will update once those changes have been released

[PatMyron]

Taking longer than expected for AWS::Serverless transform UpdateReplacePolicy support so I've exempted those two AWS::Lambda resource types from evaluation in W3011, so it should be enforceable as of 0.31.1, which is available through pip3 install cfn-lint --upgrade

Sorry for delays and thanks for waiting

[mhart]

I'm still getting this with the below template:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:

  Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain

  Function:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs12.x
      Events:
        ObjectCreated:
          Type: S3
          Properties:
            Bucket: !Ref Bucket
            Events: s3:ObjectCreated:*

[cfn-lint] W3011: Both UpdateReplacePolicy and DeletionPolicy are needed to protect Resources/Bucket from deletion

EDIT: Looking at the transformed template, it seems there's still the same issue with SAM – it removes the UpdateReplacePolicy:

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  Bucket:
    DeletionPolicy: Retain
    DependsOn:
    - FunctionObjectCreatedPermission
    Properties:
      NotificationConfiguration:
        LambdaConfigurations:
        - Event: s3:ObjectCreated:*
          Function:
            Fn::GetAtt:
            - Function
            - Arn
    Type: AWS::S3::Bucket
# ...

Commented on the SAM repo over at: aws/serverless-application-model#450 (comment)