vpc-endpoint-service: impossible to change removal policy

[slunk]

Describe the bug

This snippet fails to compile:

const vpces = new VpcEndpointService(this, 'Id', {
  vpcEndpointServiceLoadBalancers: [nlb],
});
vpces.applyRemovalPolicy(RemovalPolicy.RETAIN);

Expected Behavior

Build succeeds, and the Cloudformation stack managing this vpc endpoint service has a resource whose removal policy is set to RETAIN.

Current Behavior

This error is emitted:

Error: Cannot apply RemovalPolicy: no child or not a CfnResource. Apply the removal policy on the CfnResource directly.

Reproduction Steps

Create a stack with a VpcEndpointService and set its removal policy.

Possible Solution

Set the defaultChild for this construct.

Additional Information/Context

No response

CDK CLI Version

2.144.0

Framework Version

No response

Node.js Version

v20.3.0

OS

linux

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

applyRemovalPolicy only works with CfnResource

try this instead:

    const vpces = new ec2.VpcEndpointService(this, 'Id', {
      vpcEndpointServiceLoadBalancers: [nlb],
    });
    (vpces.node.tryFindChild('Id') as CfnVPCEndpointService).applyRemovalPolicy(RemovalPolicy.RETAIN);

Let me know if it works for you.

[slunk]

Hi Pahud. I'm not especially interested in a workaround because I've already found one.

vpces["endpointService"].applyRemovalPolicy(RemovalPolicy.RETAIN);

If you don't consider this a bug, feel free to resolve. Your suggestion seems a bit obtuse, though. How am I, a CDK user, meant to figure that out from the documentation? It also seems inconsistent with other established constructs. I can call applyRemovalPolicy on S3 buckets, network load balancers, etc...

[pahud]

Hi @slunk

applyRemovalPolicy() is a method available in some L2 constructs, such as:

BucketPolicy

https://github.com/aws/aws-cdk/blob/efee07d6f17356b52b2a2e120ebe0404f554188b/packages/aws-cdk-lib/aws-s3/lib/bucket-policy.ts#L104-L111

Redshift Table

https://github.com/aws/aws-cdk/blob/efee07d6f17356b52b2a2e120ebe0404f554188b/packages/%40aws-cdk/aws-redshift-alpha/lib/table.ts#L292-L294

If you look at its implementation, it essentially runs the applyRemovalPolicy() on this.resource which is the L1 resource behind the L2 construct.

The reason I am not considering it a bug is

1. It's not a required method for a L2 construct, but could be nice to have as a feature request.
2. Without that L2 construct method, we still can do that with a very simple workaround from ALL L2 constructs. The tip is first find out the L1 resource using tryFindChild to access the L1 Node and then just applyRemovalPolicy() from that L1 node.

We appreciate your PR to expose that method to the L2 surface. Unfortunately it was closed by the bot. This is a nice feature request though. Feel free to submit a new one for that and let me know if you need any help. You can find me on cdk.dev if you need any help.

[slunk]

Fair enough, thanks for the explanation! I'll try to fix that request and resubmit when I get some time.