Smart manual approval for CI/CD

[lielran]

When working on CD project. every commit to the master branch is pushed to production in cd pipeline. changes to the cloudformation can be risky since it can destroy the sate of the application (replace resources, cause downtime)

I would like to see an option for cdk to create a CFN change-set and wait for manual approval(e.g. cdk deploy --manual-approval=10m) on the change-set so human can review. I will also be nice to get SNS notification on this event so I can connect our Slack for ping the team.

[skinny85]

Hey @lielran ,

thanks for opening the issue. CI/CD is a very important subject to us, and something we're constantly trying to improve in the CDK.

I wonder whether the following setup would work for you: after your source Action that picks up your commit to master, you have a CodePipeline Stage with the following 3 Actions, one after the other:

• a CloudFormationCreateReplaceChangeSetAction
• a ManualApprovalAction
• a CloudFormationExecuteChangeSetAction

This way, the changes would be stopped in the Pipeline until somebody presses the approve button.

Let me know if this accomplishes what you needed, without any changes to the framework.

Thanks,
Adam

[lielran]

for the projects that I'm using CodePipeline ManualApprovalAction option is probably ok as long as cdk-cli will wait(till timeout) for my action and not apply the changeset imminently.
how you can get this experience today using cdk?

but for my other project that is using other ci/cd tools(jenkins/circleci/...) I also need a solution that acts the same.

[lielran]

On second thought, ManualApprovalAction is not a good solution since it will require manual approval on each deployment even if CFN not change (nothing to apply/create) this happens 90% of the times, right? so I would like to see CDK go to the flow of ManualApprovalAction only the only 10% of the time where there are some resources to create/update/delete

[skinny85]

for the projects that I'm using CodePipeline ManualApprovalAction option is probably ok as long as cdk-cli will wait(till timeout) for my action and not apply the changeset imminently.

That's exactly what will happen. The CloudFormationCreateReplaceChangeSetAction prepares the ChangeSet, but doesn't execute it; that's what the CloudFormationExecuteChangeSetAction does. If you put a manual approval in between them, the ChangeSet will not be executed until somebody reviews and approves it.

We have an example of that here.

[lielran]

@skinny85 - Thanks for the code sample. I can see that step 2 ManualApprovalAction is happening all the time which I found annoying.

I'm not sure what is the scope of the feature that you want or can do but IMO cdk-cli need to solve this issue by providing an interface of manual approval reneging my current CD tool.
so either it AWS CodePipeline or Circleci or Jenkins or XXX it will act the same.