Supported Features

cdkd deploys the CloudFormation template that your CDK app produces. Whether your app works with cdkd therefore depends on which template features cdkd understands. This page lists them, and starts with the few that behave differently from CloudFormation.

Two related lists are on other pages. Supported Resources has the resource types cdkd can deploy, and cdkd local invoke has the Lambda runtimes it runs locally.

What behaves differently from CloudFormation

UpdatePolicy is ignored

cdkd does not process UpdatePolicy, which covers CodeDeployLambdaAliasUpdate and the Auto Scaling rolling-update policies. It applies the update in one step instead.

For example, a Lambda alias with a CodeDeploy update policy switches to the new version at once. CloudFormation would shift traffic to it gradually through CodeDeploy. cdkd skips this on purpose, to keep dev and test deploys fast. The CodeDeploy application and deployment group resources themselves deploy normally.

Waiting for slow resources

cdkd's default waits for less than CloudFormation does, and two flags change that. See Choose a Wait Mode.

Intrinsic Functions

Fn::Split refuses an attribute whose value is already a list. Two such attributes are NameServers of AWS::Route53::HostedZone and Ipv6CidrBlocks of AWS::EC2::VPC. Remove the Fn::Split and use the Fn::GetAtt directly.

Use Another Stack's Outputs explains Fn::ImportValue and Fn::GetStackOutput, including how they read from CloudFormation-managed stacks.

S3 bucket DomainName outside the commercial partition

Fn::GetAtt <Bucket>.DomainName on an AWS::S3::Bucket returns S3's global host, <bucket>.s3.<url-suffix>. This is the spelling aws-cdk-lib uses for the bucketDomainName of a bucket imported with Bucket.fromBucketAttributes. The global host serves the bucket in the commercial (aws) partition, but not in aws-cn or aws-us-gov:

In aws-cn and aws-us-gov, reference RegionalDomainName instead (bucket.bucketRegionalDomainName in CDK). It returns <bucket>.s3.<region>.<url-suffix>, the bucket's regional endpoint, which exists in those partitions too.

Pseudo Parameters

Resource Provisioning

cdkd deploys a resource in one of two ways. For more than 90 resource types it has an SDK provider, which is cdkd's own code for calling that service's API directly. These cover the most-used services: IAM, Lambda, S3, DynamoDB, EC2, RDS, ECS, API Gateway, CloudFront, Step Functions, EFS, KMS, Cognito, AppSync and more.

Any other CloudFormation resource type goes through the Cloud Control API, AWS's generic resource API. If neither way supports a type, the deploy fails with an error that names the type.

Supported Resources has the per-type table, and Provisioning Layers explains how a resource is routed.

Template features

Secrets from dynamic references stay out of state

A dynamic reference to a secret, such as {{resolve:secretsmanager:...}}, is replaced by the secret's value during a deploy. cdkd never stores that value as plaintext. For a Secrets Manager secret or an SSM SecureString parameter, cdkd keeps the unresolved {{resolve:...}} expression in state, its record of what it deployed.

The same holds for nested stacks, in both directions. A secret passed down through a nested stack's Parameters is redacted in the child stack's state. A redacted output of a child stack is resolved again before cdkd sends it to AWS.

Deploy behavior

Rollback and drift detection have their own pages: Roll Back a Failed Deploy and Detect and Fix Drift.

A write-only property is one AWS accepts but never returns, such as a password. On a Cloud Control update, cdkd sends such a property again, using the type's schema from cloudformation:DescribeType to find it. If the schema cannot be read, the update still proceeds.

Related

• Supported Resources: per-type provider coverage
• cdkd local invoke: the Lambda runtimes emulated locally
• Use Another Stack's Outputs: how Fn::ImportValue and Fn::GetStackOutput resolve
• Troubleshooting: what to do when something is not supported