Support Functions as DeletionPolicy/UpdateReplacePolicy Values

[jthomerson]

Currently the DeletionPolicy attribute for any resource can only be a string. This means we can't use functions like !If [ IsProduction, 'Retain', 'Delete' ].

I'd expect to be able to use conditions and other CloudFormation functions as a value for a DeletionPolicy the same as I can elsewhere in the template.

Others who have asked the same thing:

• https://forums.aws.amazon.com/message.jspa?messageID=560586
• Using a Condition in the DeletionPolicy of a resource is deemed invalid. aws/aws-cli#3825

[bdrx312]

It would be nice if the DeletionPolicy also accepted a parameter from the Parameters section although you could work around that if DeletionPolicy at least supported !If

[PatMyron]

A workaround until proper support is having multiple duplicate resources with different policies and using Conditions to create only resources with correct policies

[jthomerson]

Yeah, @PatMyron, that works, but I'm sure you'd agree that "copy and paste your resources and hope you always remember to keep them in sync" is a pretty bad pattern. 😜 Glad you added "until this is properly supported" ... that gives me hope!

[bdrx312]

That work around is really bad if you have an resources that have dependencies (DependsOn) on the resources.

[danieljamesscott]

I think that a better work around is to use AWS::Include and parameterise the name of the included snippet:

"Fn::Transform" : {
  "Name" : "AWS::Include",
  "Parameters" : {
    "Location" : {"Fn::Sub": "s3://${S3Bucket}/deletionPolicy/${RDSDeletionPolicy}.json" }
  }
}

It does mean you have to have snippets for all possible values (and a separate set for UpdateReplacePolicy), but better than duplicating resources.

[PatMyron]

@danieljamesscott due to AWS::Include regional availability, I've used Jinja to avoid maintaining duplicate source code

[bdrx312]

The AWS::Include that @danieljamesscott mentioned is a better work around than having duplicate resources but as @PatMyron mentioned is not available in all regions.

[danieljamesscott]

I've also just discovered that you can't use that work around for multiple policies (DeletionPolicy and UpdateReplacePolicy for example) because it results in duplicate keys in the JSON. The work around for that is to generate transforms with each combination of the 3 possibilities.

If AWS would just let us parameterise the policies it would save all this craziness... :)