0021. Environment-aware removal policies for CDK-managed resources
Status: Accepted
Date: 2026-03-27
Context: CDK RemovalPolicy must balance destroy vs retain by environment and resource type without orphans or data loss.
Context
AWS CDK resources support a RemovalPolicy that determines whether resources are deleted or retained when a stack is destroyed or a resource is replaced.
A blanket policy (e.g. RETAIN for all production resources) can lead to:
- Orphaned infrastructure
- Increased operational overhead
- Naming conflicts on redeploy
Conversely, using DESTROY universally risks irreversible data loss for stateful resources.
Decision
Adopt an environment-sensitive and resource-type-aware removal policy strategy:
1. Environment Rules
2. Resource Classification
Stateful (RETAIN in production):
- Databases (RDS, DynamoDB)
- Object storage (S3)
- Identity systems (Cognito User Pools)
- Persistent volumes (EFS)
- Search/indexing (OpenSearch)
- Encryption keys (KMS)
Stateless (DESTROY in production):
- Compute (Lambda, ECS)
- API layers (API Gateway, ALB)
- IAM roles/policies
- Eventing (EventBridge)
- Networking components
3. Additional Safeguards
- Enable CloudFormation termination protection on production stacks
- Restrict deletion via IAM policies where appropriate
Consequences
Positive
- Protects critical production data from accidental deletion
- Keeps non-prod environments disposable and cost-efficient
- Avoids unnecessary retention of reproducible infrastructure
Negative
- Retained resources become orphaned if stacks are deleted
- Manual cleanup or import may be required
- Requires discipline in correctly classifying resources
Notes
Retention is a data protection mechanism, not a substitute for:
- Backups
- Disaster recovery
- Access control
Stack deletion in production should be considered an exceptional operation.