Escape hatch: be able to delete an entire resource from the subtree

[eladb]

Sometimes users might want to delete an entire resource.

See #1404 for a use case

[fisherpro]

If a certain cdk object creates a role, how do I then stop that role from being created?
If I am reading this issue correctly, this is impossible today?

I may need to abandon AWS CDK in my organization.

There are certain resources I am not allowed to create with my user's AWS Role. I was hoping to be able to delete the resources and reference an ARN where needed instead of having then created with cdk.

Thank you

[eladb]

This is definitely in our roadmap and a legitimate request. Many AWS constructs allow you to pass in an IRole instead of auto-creating the role. Was there a specific construct that you are using that didn't support it?

[fisherpro]

Hi @eladb, Thanks for the reply.

I was attempting to use an AutoscalingGroup instance, but the role that is passed in (thank you for allowing a role to be passed in btw) to a new InstanceProfile. But creating an Instance profile is also an off-limits IAM function within my organization. So my thought was to simply delete the Instance Profile and use an existing one within my Amazon account. I could not figure out how to delete the Instance Profile that was created by the AutoscalingGroup.

I think the above problem is related to this issue. Correct?

Thanks

[dsharkou]

@jcamilli I have the same for the customer (but for ecs.FargateTaskDefinition- on addContainer it creates redundant for me IAM Policy to create log stream and put log events)
@eladb Do you have any updates on this?

[konstantinj]

Would like this feature. I just wanted to add a custom route table to my subnets while still using the VPC construct. I have a new route table but I can't remove the already existing ones.

[pasieronen]

I have a similar use case: would like to use existing Elastic IPs with NAT Gateways. I can override the NAT Gateway's allocationId by:

const natGateway1 = vpc.node.findChild('publicSubnet1').node.findChild('NATGateway') as CfnNatGateway
natGateway1.allocationId = /* something */

but I can't remove the EIPs created by the VPC construct...

EDITED: Apparently this works, but it would be nice to a have a publicly documented deleteChild API...

 delete (vpc.node.findChild('publicSubnet1').node as any)._children['EIP']