Describe the bug
I'm deploying stacks with toolkit-lib and the stack has iam role. On deployment it gives the changes (which is fine) but then puts a message like
"--require-approval" is enabled and stack includes security-sensitive updates.
Do you wish to deploy these changes
Then proceeds to deploy. I added "@aws-cdk/toolkit:requireApproval": "never", in cdk.json of my root so it passes but I would like to suppress that message.
Total logs
Stack8
Stack Stack8
IAM Statement Changes
┌───┬───────────────────────┬────────┬────────────────┬───────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼───────────────────────┼────────┼────────────────┼───────────────────────────┼───────────┤
│ + │ ${S3ReadOnlyRole.Arn} │ Allow │ sts:AssumeRole │ Service:ec2.amazonaws.com │ │
└───┴───────────────────────┴────────┴────────────────┴───────────────────────────┴───────────┘
IAM Policy Changes
┌───┬───────────────────┬──────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼───────────────────┼──────────────────────────────────────────────────────────────┤
│ + │ ${S3ReadOnlyRole} │ arn:${AWS::Partition}:iam::aws:policy/AmazonS3ReadOnlyAccess │
└───┴───────────────────┴──────────────────────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
"--require-approval" is enabled and stack includes security-sensitive updates.
Do you wish to deploy these changes
Stack8: deploying... [9/10]
Stack8: creating stack...
Stack8 | 0 | 4:00:55 PM | CREATE_IN_PROGRESS | AWS::CloudFormation::Stack | Stack8 User Initiated
Stack8 | 0 | 4:00:57 PM | CREATE_IN_PROGRESS | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata)
Stack8 | 0 | 4:00:57 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | S3ReadOnlyRole (S3ReadOnlyRoleFA2E4025)
Stack8 | 0 | 4:00:58 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | S3ReadOnlyRole (S3ReadOnlyRoleFA2E4025) Resource creation Initiated
Stack8 | 0 | 4:00:58 PM | CREATE_IN_PROGRESS | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata) Resource creation Initiated
Stack8 | 1 | 4:00:59 PM | CREATE_COMPLETE | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata)
Stack8 | 2 | 4:01:14 PM | CREATE_COMPLETE | AWS::IAM::Role | S3ReadOnlyRole (S3ReadOnlyRoleFA2E4025)
Stack8 | 3 | 4:01:15 PM | CREATE_COMPLETE | AWS::CloudFormation::Stack | Stack8
✅ Stack8
✨ Deployment time: 21.81s
Stack used
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';
// import * as sqs from 'aws-cdk-lib/aws-sqs';
export class Cdk20250826Stack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// IAM role with S3 readonly access
new iam.Role(this, 'S3ReadOnlyRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess')
]
});
}
}Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
an option to suppress the message
"--require-approval" is enabled and stack includes security-sensitive updates.
Do you wish to deploy these changes
Current Behavior
even though require-approval is not on it still shows up in the logs
Reproduction Steps
cdk_20250826.ts
Reduce the loop size to 1 and deploy with command node bin/cdk_20250826.js deploy
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.1026.0
Framework Version
No response
Node.js Version
v20.19.3
OS
macOS 15.6
Language
TypeScript
Language Version
No response
Other information
No response
Describe the bug
I'm deploying stacks with toolkit-lib and the stack has iam role. On deployment it gives the changes (which is fine) but then puts a message like
Then proceeds to deploy. I added
"@aws-cdk/toolkit:requireApproval": "never",in cdk.json of my root so it passes but I would like to suppress that message.Total logs
Stack used
Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
an option to suppress the message
Current Behavior
even though require-approval is not on it still shows up in the logs
Reproduction Steps
cdk_20250826.ts
Reduce the loop size to 1 and deploy with command
node bin/cdk_20250826.js deployPossible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.1026.0
Framework Version
No response
Node.js Version
v20.19.3
OS
macOS 15.6
Language
TypeScript
Language Version
No response
Other information
No response