feat(eks): add removal policy support for EKS cluster construct #35560

aemada-aws · 2025-09-23T15:25:46Z

Issue # (if applicable)

Reason for this change

Added the removalPolicy prop to the EKS cluster. This will apply the removal policy to all resources created by the cluster including node groups, roles, vpc and security groups. This also includes the custom resource that created the construct. Currently this is possible with RemovalPolicies.of(cluster).apply but this is not a user friendly API, this PR just abstracts that with a removalPolicy prop which is the expected behavior when using L2s.

Description of changes

Added removalPolicy property to the ClusterProps interface in the EKS library that allows users to specify a removal policy for all CloudFormation resources created by the EKS cluster construct.

Added readonly removalPolicy?: RemovalPolicy to ClusterProps interface
Added integration test integ.eks-cluster-retain.ts to verify removal policy functionality with RemovalPolicy.DESTROY. If it deploys with destroy, it will also deploy with retain. The reason we don't write a specific retain integ test is that it will orphan resources in the account for anyone who deploys the integ test.

The removal policy affects the EKS cluster itself, associated IAM roles, node groups, security groups, VPC resources, and any other CloudFormation resources managed by this construct.

Describe any new or updated permissions being added

No new IAM permissions are required for this change.

Description of how you validated changes

Added integration test integ.eks-cluster-retain.ts that creates an EKS cluster with RemovalPolicy.RETAIN
The test verifies that all resources can be deployed successfully with the removal policy applied, and the snapshot validates we added the policy to all resources.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

kumsmrit · 2025-10-06T11:40:29Z

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

+   * This affects the EKS cluster itself, associated IAM roles, node groups, security groups, VPC
+   * and any other CloudFormation resources managed by this construct.
+   *
+   * @default - Resources will follow their default removal policies


Shouldn't the default value be RETAIN here?

The default is delete in CFN, i can update that.

kumsmrit · 2025-10-06T11:53:23Z

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

  readonly remotePodNetworks?: RemotePodNetwork[];
+
+  /**
+   * The removal policy applied to all CloudFormation resources created by this construct


removal policy applied to all CloudFormation resources created by this construct

Is this intended? When removalPolicy is set to DESTROY, it could affect shared resources like VPC, security groups, etc. that might be getting used elsewhere?

It should not affect the VPC passed by the user (if any), only if the construct created its own default vpc. I will add a unit test to verify that. RemovalPolicies.of(this).apply affects resources created under the construct, not the ones passed to it.

RemovalPolicies.of(this).apply affects resources created under the construct

But can these resources created by the construct be shared or referenced by other resources outside this construct?
For example, if this construct creates security groups or IAM roles that are later referenced by other services, applying DESTROY removal policy on such resources could cause issues.

It is not expected that customers reuse the default resources created the construct on another service, instead they should have provided a role to the construct. Anyway the default is delete, and this is a known default by CFN. If they pass RETAIN, and the role/vpc are retained then it is also expected because the cluster cannot function without them. If a resource is referenced somewhere else in the stack, you cannot even delete it because that will fail the deployment and in CDK the typechecking/synth would also fail.

mergify · 2025-10-07T16:58:29Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-10-07T16:58:34Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

mergify · 2025-10-07T17:02:48Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aemada-aws · 2025-10-08T15:42:14Z

@Mergifyio update

mergify · 2025-10-08T15:42:25Z

update

❌ Mergify doesn't have permission to update

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/integration-test-deployment.yml without workflows permission

mergify · 2025-10-08T16:22:06Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-10-08T16:24:58Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-10-08T16:25:17Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aemada-aws marked this pull request as draft September 23, 2025 15:25

aws-cdk-automation requested a review from a team September 23, 2025 15:25

github-actions bot added the p2 label Sep 23, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Sep 23, 2025

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch from 63c3f76 to 9a7715e Compare September 23, 2025 15:26

aws-cdk-automation previously requested changes Sep 23, 2025

View reviewed changes

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch 2 times, most recently from 68f0857 to c4a5575 Compare September 25, 2025 13:28

aemada-aws marked this pull request as ready for review September 25, 2025 13:30

github-actions bot mentioned this pull request Oct 1, 2025

Monthly PR metrics report #35642

Open

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch 2 times, most recently from 5b73c19 to 58e7399 Compare October 1, 2025 09:48

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch 2 times, most recently from 05ddd5a to b9a6607 Compare October 6, 2025 07:44

github-actions bot added effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. labels Oct 6, 2025

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch 2 times, most recently from 3cbc600 to 065fa26 Compare October 6, 2025 11:22

kumsmrit reviewed Oct 6, 2025

View reviewed changes

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch 2 times, most recently from 67aab2c to f86be7a Compare October 6, 2025 11:49

kumsmrit reviewed Oct 6, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 6, 2025

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch from f86be7a to 72ff301 Compare October 7, 2025 14:21

aemada-aws had a problem deploying to deployment-integ-test October 7, 2025 14:21 — with GitHub Actions Error

feat(eks): add removal policy support for cluster

6f5aded

aemada-aws force-pushed the removal-policy-eks-v2-alpha branch from 72ff301 to 6f5aded Compare October 7, 2025 16:28

aemada-aws had a problem deploying to deployment-integ-test October 7, 2025 16:28 — with GitHub Actions Error

kumsmrit approved these changes Oct 7, 2025

View reviewed changes

mergify bot added the queued label Oct 7, 2025

mergify bot removed the queued label Oct 7, 2025

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 7, 2025

Merge branch 'main' into removal-policy-eks-v2-alpha

0d2affa

aemada-aws had a problem deploying to deployment-integ-test October 8, 2025 15:42 — with GitHub Actions Failure

mergify bot added the queued label Oct 8, 2025

mergify bot merged commit 4b4e322 into aws:main Oct 8, 2025
27 of 28 checks passed

mergify bot removed the queued label Oct 8, 2025

github-actions bot locked as resolved and limited conversation to collaborators Oct 8, 2025

feat(eks): add removal policy support for EKS cluster construct #35560

feat(eks): add removal policy support for EKS cluster construct #35560

Uh oh!

Conversation

aemada-aws commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kumsmrit Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kumsmrit Oct 7, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Oct 7, 2025

Uh oh!

mergify bot commented Oct 7, 2025

Uh oh!

mergify bot commented Oct 7, 2025

Uh oh!

aemada-aws commented Oct 8, 2025

Uh oh!

mergify bot commented Oct 8, 2025

❌ Mergify doesn't have permission to update

Uh oh!

mergify bot commented Oct 8, 2025

Uh oh!

mergify bot commented Oct 8, 2025

Uh oh!

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aemada-aws commented Sep 23, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aemada-aws Oct 6, 2025 •

edited

Loading

aemada-aws Oct 7, 2025 •

edited

Loading