fix

Author: mrgrain

packages/@aws-cdk-testing/cli-integ/lib/shell.ts

@@ -68,9 +68,22 @@ export async function shell(command: string[], options: ShellOptions = {}): Prom
 
           // now write the input with a slight delay to ensure
           // the child process has already started reading.
-          setTimeout(() => {
+          const sendInput = () => {
             child.writeStdin(interaction.input + (interaction.end ?? os.EOL));
-          }, 500);
+          };
+
+          if (interaction.beforeInput) {
+            void interaction.beforeInput()
+              .catch((err) => {
+                writeToOutputs(`\n[Prompt: ${interaction.prompt.toString()}] beforeInput hook failed!\n`);
+                writeToOutputs(`${err}\n\n`);
+              })
+              .finally(() => {
+                setTimeout(sendInput, 500);
+              });
+          } else {
+            setTimeout(sendInput, 500);
+          }
         }
       }
     });
@@ -100,7 +113,7 @@ export async function shell(command: string[], options: ShellOptions = {}): Prom
       const stdoutOutput = Buffer.concat(stdout).toString('utf-8');
       const out = (options.onlyStderr ? stderrOutput : stdoutOutput + stderrOutput).trim();
 
-      const logAndreject = (error: Error) => {
+      const logAndReject = (error: Error) => {
         if (show === 'error') {
           writeToOutputs(`${out}\n`);
         }
@@ -109,15 +122,15 @@ export async function shell(command: string[], options: ShellOptions = {}): Prom
 
       if (remainingInteractions.length !== 0) {
         // regardless of the exit code, if we didn't consume all expected interactions we probably
-        // did somethiing wrong.
-        logAndreject(new Error(`Expected more user interactions but subprocess exited with ${code}`));
+        // did something wrong.
+        logAndReject(new Error(`Expected more user interactions but subprocess exited with ${code}`));
         return;
       }
 
       if (code === 0 || options.allowErrExit) {
         resolve(out);
       } else {
-        logAndreject(new Error(`'${command.join(' ')}' exited with error code ${code}.`));
+        logAndReject(new Error(`'${command.join(' ')}' exited with error code ${code}.`));
       }
     });
   });
@@ -168,6 +181,12 @@ export interface UserInteraction {
    * @default os.EOL
    */
   readonly end?: string;
+
+  /**
+   * An async callback to run after the prompt is matched but before the input is sent.
+   * Useful for verifying external state while the process is paused at a prompt.
+   */
+  readonly beforeInput?: () => Promise<void>;
 }
 
 export interface ShellOptions extends child_process.SpawnOptions {

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/deploy/cdk-deploy-with-any-change-approval-shows-diff.integtest.ts

@@ -1,7 +1,5 @@
 import { integTest, withDefaultFixture } from '../../../lib';
 
-jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
-
 integTest(
   'deploy with any-change approval shows diff',
   withDefaultFixture(async (fixture) => {

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/deploy/cdk-deploy-with-change-set-approval-diff.integtest.ts

@@ -0,0 +1,53 @@
+import { DescribeStacksCommand, ListChangeSetsCommand } from '@aws-sdk/client-cloudformation';
+import { integTest, withDefaultFixture } from '../../../lib';
+
+integTest(
+  'deploy with change-set method uses change set for approval diff',
+  withDefaultFixture(async (fixture) => {
+    let changeSetVerified = false;
+    const stackName = fixture.fullStackName('test-2');
+    const changeSetName = `${fixture.stackNamePrefix}-approval-diff-test`;
+
+    // Deploy with --require-approval=any-change without --yes.
+    // The CLI will create a change set for the approval diff, pause for confirmation,
+    // and then execute the same change set after the user confirms.
+    const output = await fixture.cdkDeploy('test-2', {
+      options: ['--require-approval=any-change', '--method=change-set', `--change-set-name=${changeSetName}`],
+      neverRequireApproval: false,
+      interact: [
+        {
+          prompt: /Do you wish to deploy these changes/,
+          input: 'y',
+          beforeInput: async () => {
+            // While the CLI is paused at the approval prompt, verify that
+            // the named change set has been created and is ready for execution.
+            const response = await fixture.aws.cloudFormation.send(
+              new ListChangeSetsCommand({ StackName: stackName }),
+            );
+            const changeSets = response.Summaries ?? [];
+            const namedChangeSet = changeSets.find(cs => cs.ChangeSetName === changeSetName);
+            expect(namedChangeSet).toBeDefined();
+            expect(namedChangeSet?.Status).toEqual('CREATE_COMPLETE');
+            changeSetVerified = true;
+          },
+        },
+      ],
+      modEnv: {
+        FORCE_COLOR: '0',
+      },
+    });
+
+    // The approval diff should contain resource information from the change set
+    expect(output).toContain('AWS::SNS::Topic');
+    expect(output).toContain('Do you wish to deploy these changes');
+
+    // Verify the beforeInput callback actually ran
+    expect(changeSetVerified).toBe(true);
+
+    // Verify the stack was actually deployed
+    const response = await fixture.aws.cloudFormation.send(
+      new DescribeStacksCommand({ StackName: fixture.fullStackName('test-2') }),
+    );
+    expect(response.Stacks?.[0].StackStatus).toEqual('CREATE_COMPLETE');
+  }),
+);

packages/@aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts

@@ -125,7 +125,7 @@ export interface DeployStackOptions {
    *
    * @default - Change set with defaults
    */
-  readonly deploymentMethod?: DeploymentMethod;
+  readonly deploymentMethod?: DeploymentMethod | ExecuteChangeSetDeployment;
 
   /**
    * The collection of extra parameters
@@ -346,6 +346,15 @@ type CommonExecuteOptions = keyof CreateStackCommandInput &
 keyof UpdateStackCommandInput &
 keyof ExecuteChangeSetCommandInput;
 
+/**
+ * Execute a previously created change set.
+ * This is an internal deployment method used by the two-phase deploy flow.
+ */
+export interface ExecuteChangeSetDeployment {
+  readonly method: 'execute-change-set';
+  readonly changeSetName: string;
+}
+
 /**
  * This class shares state and functionality between the different full deployment modes
  */
@@ -357,7 +366,7 @@ class FullCloudFormationDeployment {
   private readonly uuid: string;
 
   constructor(
-    private readonly deploymentMethod: DirectDeployment | ChangeSetDeployment,
+    private readonly deploymentMethod: DirectDeployment | ChangeSetDeployment | ExecuteChangeSetDeployment,
     private readonly options: DeployStackOptions,
     private readonly cloudFormationStack: CloudFormationStack,
     private readonly stackArtifact: cxapi.CloudFormationStackArtifact,
@@ -384,6 +393,9 @@ class FullCloudFormationDeployment {
       case 'change-set':
         return this.changeSetDeployment(deploymentMethod);
 
+      case 'execute-change-set':
+        return this.executeExistingChangeSet(deploymentMethod);
+
       case 'direct':
         return this.directDeployment();
     }
@@ -437,10 +449,40 @@ class FullCloudFormationDeployment {
         noOp: false,
         outputs: this.cloudFormationStack.outputs,
         stackArn: changeSetDescription.StackId!,
+        changeSet: changeSetDescription,
       };
     }
 
     // If there are replacements in the changeset, check the rollback flag and stack status
+    return this.checkAndExecuteChangeSet(changeSetDescription);
+  }
+
+  private async executeExistingChangeSet(deploymentMethod: ExecuteChangeSetDeployment): Promise<DeployStackResult> {
+    await this.updateTerminationProtection();
+
+    // The change set was already created and validated during the prepare phase,
+    // just describe it to get the info needed for execution.
+    const changeSetDescription = await this.cfn.describeChangeSet({
+      StackName: this.stackName,
+      ChangeSetName: deploymentMethod.changeSetName,
+    });
+
+    return this.checkAndExecuteChangeSet(changeSetDescription);
+  }
+
+  /**
+   * Check rollback/replacement constraints and execute the change set if all checks pass.
+   */
+  private async checkAndExecuteChangeSet(changeSetDescription: DescribeChangeSetCommandOutput): Promise<DeployStackResult> {
+    if (changeSetDescription.Status !== 'CREATE_COMPLETE') {
+      const status = changeSetDescription.Status ?? 'UNKNOWN';
+      const reason = changeSetDescription.StatusReason ? `: ${changeSetDescription.StatusReason}` : '';
+      throw new ToolkitError(
+        'ChangeSetNotReady',
+        `Change set '${changeSetDescription.ChangeSetName}' on stack '${this.stackName}' is not ready for execution (status: ${status}${reason})`,
+      );
+    }
+
     const replacement = hasReplacement(changeSetDescription);
     const isPausedFailState = this.cloudFormationStack.stackStatus.isRollbackable;
     const rollback = this.options.rollback ?? true;
@@ -737,6 +779,12 @@ async function canSkipDeploy(
     return false;
   }
 
+  // Executing an existing change set, never skip
+  if (deployStackOptions.deploymentMethod?.method === 'execute-change-set') {
+    await ioHelper.defaults.debug(`${deployName}: executing existing change set, never skip`);
+    return false;
+  }
+
   // Drift-aware
   if (
     deployStackOptions.deploymentMethod?.method === 'change-set' &&

packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployment-result.ts

@@ -12,6 +12,12 @@ export interface SuccessfulDeployStackResult {
   readonly noOp: boolean;
   readonly outputs: { [name: string]: string };
   readonly stackArn: string;
+
+  /**
+   * The change set that was created during deployment, if any.
+   * Populated when using `change-set` deployment method with `execute: false`.
+   */
+  readonly changeSet?: any;
 }
 
 /** The stack is currently in a failpaused state, and needs to be rolled back before the deployment */

packages/@aws-cdk/toolkit-lib/lib/api/deployments/deployments.ts

@@ -14,6 +14,7 @@ import {
 import { determineAllowCrossAccountAssetPublishing } from './checks';
 
 import { deployStack, destroyStack } from './deploy-stack';
+import type { ExecuteChangeSetDeployment } from './deploy-stack';
 import type { DeployStackResult } from './deployment-result';
 import type { DeploymentMethod } from '../../actions/deploy';
 import { DeploymentError, ToolkitError } from '../../toolkit/toolkit-error';
@@ -89,7 +90,7 @@ export interface DeployStackOptions {
    *
    * @default - Change set with default options
    */
-  readonly deploymentMethod?: DeploymentMethod;
+  readonly deploymentMethod?: DeploymentMethod | ExecuteChangeSetDeployment;
 
   /**
    * Force deployment, even if the deployed template is identical to the one we are about to deploy.

packages/@aws-cdk/toolkit-lib/test/actions/deploy.test.ts

@@ -123,6 +123,83 @@ IAM Statement Changes
     }));
   });
 
+  describe('two-phase deploy with change-set approval', () => {
+    test('calls deployStack with execute:false then execute-change-set', async () => {
+      // GIVEN — first call returns change set, second executes
+      mockDeployStack
+        .mockReset()
+        .mockResolvedValueOnce({
+          type: 'did-deploy-stack',
+          noOp: false,
+          outputs: {},
+          stackArn: 'arn:aws:cloudformation:region:account:stack/test-stack',
+          changeSet: { Status: 'CREATE_COMPLETE', Changes: [{ Type: 'Resource' }] },
+        })
+        .mockResolvedValueOnce({
+          type: 'did-deploy-stack',
+          noOp: false,
+          outputs: {},
+          stackArn: 'arn:aws:cloudformation:region:account:stack/test-stack',
+        });
+
+      // WHEN
+      const cx = await builderFixture(toolkit, 'stack-with-bucket');
+      await toolkit.deploy(cx, {
+        deploymentMethod: { method: 'change-set' },
+      });
+
+      // THEN
+      expect(mockDeployStack).toHaveBeenCalledTimes(2);
+      expect(mockDeployStack).toHaveBeenNthCalledWith(1,
+        expect.objectContaining({
+          deploymentMethod: expect.objectContaining({ method: 'change-set', execute: false }),
+        }),
+      );
+      expect(mockDeployStack).toHaveBeenNthCalledWith(2,
+        expect.objectContaining({
+          deploymentMethod: expect.objectContaining({ method: 'execute-change-set' }),
+        }),
+      );
+    });
+
+    test('uses template-only diff with method=direct', async () => {
+      // WHEN
+      const cx = await builderFixture(toolkit, 'stack-with-bucket');
+      await toolkit.deploy(cx, {
+        deploymentMethod: { method: 'direct' },
+      });
+
+      // THEN — only one deployStack call with direct method
+      expect(mockDeployStack).toHaveBeenCalledTimes(1);
+      expect(mockDeployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          deploymentMethod: { method: 'direct' },
+        }),
+      );
+    });
+
+    test('skips execute when prepare returns noOp', async () => {
+      // GIVEN
+      mockDeployStack
+        .mockReset()
+        .mockResolvedValueOnce({
+          type: 'did-deploy-stack',
+          noOp: true,
+          outputs: {},
+          stackArn: 'arn:aws:cloudformation:region:account:stack/test-stack',
+        });
+
+      // WHEN
+      const cx = await builderFixture(toolkit, 'stack-with-bucket');
+      await toolkit.deploy(cx, {
+        deploymentMethod: { method: 'change-set' },
+      });
+
+      // THEN — only the prepare call
+      expect(mockDeployStack).toHaveBeenCalledTimes(1);
+    });
+  });
+
   describe('deployment options', () => {
     test('parameters are passed in', async () => {
       // WHEN