cli: add a --confirm-diff option to cdk deploy

[anentropic]

Describe the feature

One nice thing about the Pulumi cli is that it gives you the full diff for any deployment to confirm before proceeding.

AFAICT the cdk deploy cli only gives the option to confirm "security-sensitive" changes such as IAM policies etc.

      --require-approval     What security-sensitive changes need manual
                             approval
                         [string] [choices: "never", "any-change", "broadening"]

I would like an option to show the cdk diff output first, with a confirmation step.

Use Case

It's possible to do this manually, I could write a bash script that first runs cdk diff then gets confirmation then runs cdk deploy.

However due to #27991 this would be even more painfully slow than it already is, because every time I run a separate cdk cli command it does several uncached Docker builds. It takes like 5 mins per command... life is too short!

My particular use-case is to avoid issues such as this #7722 where the deployment triggered unexpected non-security-sensitive updates due to stale SSM params in the context json.

Proposed Solution

Add a --confirm-diff option to cdk deploy command that gives the output of cdk diff with a confirmation step before proceeding with the deploy.

Another option might be to extend the options for the existing --require-approval flag, but given it currently has [choices: "never", "any-change", "broadening"] that's probably more confusing.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.166.0 (build 7bb9203)

Environment details (OS name and version, etc.)

macos 14

[anentropic]

TBH even better would be... not exactly the output of cdk diff but more like the nicely formatted tabular output of --require-approval but for any change

[khushail]

@anentropic , thanks for reaching out. Your suggestions to improve the output messages displayed before the deployment takes places, sound informative and helpful. Right now, cdk deploy calculates the changeset but does not display it.
So having a message or data in tabular format makes sense to me.

Please feel free to submit a PR if you would like to. Since this is a good-to-have feature, I am marking this as P2, for contribution by the community or CDK Teammembers as well. Let me know if you need any more help!

Thanks