Champion's Launch Review

What you'll learn

Always read cdk diff before cdk deploy. Look for replacements and IAM changes first.
cdk bootstrap prepares each account and Region once. Deployments in CI use the roles it creates.
Automate with a pipeline, scan for misconfigurations, keep stateful resources protected, and know your escape hatches.

Section 01

Read the diff

cdk diff compares your synthesized template with the deployed stack and prints what would change. Two things deserve a pause: a resource marked replace (CloudFormation will create a new one and delete the old, which for a table or bucket can mean data loss), and any change to IAM statements. Make the diff part of code review.

Before every deployShell

cdk diff PokedexProd
# [~] AWS::DynamoDB::Table PokedexTable PokedexTable<hash> replace   <- stop and ask why
# "IAM Statement Changes" lists every new permission                  <- read them

Section 02

Bootstrapping

Before the first deploy to an account and Region you run cdk bootstrap aws://ACCOUNT/REGION. It creates the CDKToolkit stack: an asset bucket, an image repository, and roles for deploying, publishing and looking up context. Lookups need a concrete account and Region, so real apps pin both in env; bootstrapping then prepares that account and Region to receive deployments.

Run it once per account and Region, and again when a new CDK version needs a newer bootstrap template.
Use a custom qualifier or a permissions boundary if your organization requires one.

Section 03

Pipelines

Deploying from a laptop doesn't scale. CodePipeline from aws-cdk-lib/pipelines builds a self-mutating pipeline: you push, it synthesizes, tests, and deploys to each stage in order. You can also use GitHub Actions or any CI, calling cdk deploy with OIDC credentials, so there are no long-lived keys.

Pipelines give you the place for approvals: a manual gate before production, and the test suite from Quest 10 before anything deploys.

Section 04

Guardrails

cdk-nag is an open-source Aspect (open source, maintained under the cdklabs organization) that checks your constructs against rule packs (AWS Solutions, HIPAA, NIST, PCI) and fails the synth on findings. CDK's own Aspects let you enforce your own rules across a whole app, like “every bucket is encrypted”. Add RemovalPolicy review, termination protection and the tests from before, and you have defence in depth.

Risk	Guardrail
Data loss on replacement or delete	RETAIN, termination protection, reading cdk diff
Overly broad permissions	Grants, cdk-nag, IAM Access Analyzer
Insecure defaults	Custom constructs, Aspects, tests
Surprise cost	On-demand vs provisioned decisions, tags, budgets
Drift from the template	CloudFormation drift detection, no console edits

Section 05

Cost and escape hatches

CDK itself is free: you pay for the resources it creates. Tag everything (Quest 9), delete dev stacks, and prefer pay-per-use services for spiky workloads. When an L2 doesn't expose a property yet, use an escape hatch: reach the underlying L1 with bucket.node.defaultChild and set the raw CloudFormation property.

Escape hatch

const cfnBucket = bucket.node.defaultChild as s3.CfnBucket;
// A property the L2 does not expose yet (placeholder name):
cfnBucket.addPropertyOverride("NewCloudFormationProperty", "value");

Practice

Your turn

The launch review found problems in the production stack. The table and the bucket would be deleted with the stack, and the bucket also auto-deletes its objects (remove autoDeleteObjects: it only works with DESTROY). The table has no deletion protection or point-in-time recovery. The bucket isn't versioned and accepts plain HTTP. The stack itself can be deleted by accident. Fix all of them.

Table: RETAIN, deletionProtection, point-in-time recovery. Bucket: RETAIN (no auto-delete), versioned, enforceSSL. Stack: terminationProtection.

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import { Construct } from "constructs";
export class PokedexStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    // ⬇️ Harden the table and the bucket for production.
    const table = new dynamodb.Table(this, "PokedexTable", {
      partitionKey: { name: "pokedexNumber", type: dynamodb.AttributeType.NUMBER },
      sortKey: { name: "formId", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
    new s3.Bucket(this, "CardsBucket", {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });
  }
}
const app = new cdk.App();
new PokedexStack(app, "PokedexStack", {
  env: { region: "ap-south-1" },
  // ⬇️ Protect the stack itself from being deleted by accident.
});

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import { Construct } from "constructs";

export class PokedexStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    // ⬇️ Harden the table and the bucket for production.
    const table = new dynamodb.Table(this, "PokedexTable", {
      partitionKey: { name: "pokedexNumber", type: dynamodb.AttributeType.NUMBER },
      sortKey: { name: "formId", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    new s3.Bucket(this, "CardsBucket", {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });
  }
}

const app = new cdk.App();
new PokedexStack(app, "PokedexStack", {
  env: { region: "ap-south-1" },
  // ⬇️ Protect the stack itself from being deleted by accident.
});

Ctrl/⌘ Enter to run · simulated, no AWS callsSimulated — no AWS calls

The simulator runs the constructs this course teaches, plus simple loops and helper methods. Other CDK code may not be recognised.

Check

Check your understanding

Quick Quiz · one question, as many tries as you need.

In cdk diff for production, a DynamoDB table is marked as replace after a small key change. What do you do?

Choose one answer.