core: CDK breaks when CFN template is updated outside of CDK

[nonspecialist]

Describe the bug

This one was a surprise and only came about because of a mistake. This issue has been replicated with CDK 2.1138.0 (build a4c0282).

An existing CFN stack (created by CDK) with a resource with a DeletionPolicy can be updated outside of CDK in a way that breaks all future CDK runs against that stack, while being perfectly acceptable to CloudFormation.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

CDK should not break on existing templates that CloudFormation is quite happy with

Current Behavior

A manual update to a stack can cause CDK to fail in unexpected ways; diagnosing the problem via the console or AWS CLI does NOT reveal the problem.

Reproduction Steps

1. Start with an existing CDK app created without modification using the CDK "getting started" example (mkdir hello-world && cd hello-world && cdk init sample-app --language=typescript) and deployed
2. Copy the JSON template (either from the CloudFormation console, or from aws cloudformation get-template ...) and, in the resource definition for the AWS::SQS::Queue, make the following change:

FROM

    "CdkShouldFailQueueF196B131": {
      "Type": "AWS::SQS::Queue",
      "Properties": {
        "VisibilityTimeout": 300
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete",
      "Metadata": {
        "aws:cdk:path": "CdkShouldFailStack/CdkShouldFailQueue/Resource"
      }
    },

TO

    "CdkShouldFailQueueF196B131": {
      "Type": "AWS::SQS::Queue",
      "Properties": {
        "VisibilityTimeout": 300
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete",
      "UpdateReplacePolicy": "Retain",
      "DeletionPolicy": "RetainExceptOnCreate",
      "Metadata": {
        "aws:cdk:path": "CdkShouldFailStack/CdkShouldFailQueue/Resource"
      }
    },

A second UpdateReplacePolicy and DeletionPolicy key has been added.
3. Update the stack in place (either via changeset or directly), using the console or command line but NOT using CDK
4. Now do cdk diff and see the failure Map keys must be unique; "UpdateReplacePolicy" is repeated

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.266.0

AWS CDK CLI version

2.1138.0 (build a4c0282)

Node.js Version

Node.js v22.22.2

OS

Linux (Fedora 43)

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @nonspecialist,

I was able to reproduce this locally at the parser level without deploying any AWS resources.

The issue reports CDK CLI 2.1138.0 with aws-cdk-lib 2.266.0. I reproduced the exact error using Node.js 24 and yaml@1.10.3, matching the YAML v1 parser used by @aws-cdk/toolkit-lib.

npm install yaml@1.10.3

// repro.js
const yaml = require('yaml');

const template = `{
  "Resources": {
    "Queue": {
      "Type": "AWS::SQS::Queue",
      "UpdateReplacePolicy": "Delete",
      "UpdateReplacePolicy": "Retain"
    }
  }
}`;

console.log(
  'JSON.parse:',
  JSON.parse(template).Resources.Queue.UpdateReplacePolicy,
);

yaml.parse(template, { schema: 'core' });

node repro.js

Output:

JSON.parse: Retain
YAMLSemanticError: Map keys must be unique;
"UpdateReplacePolicy" is repeated

This reproduces the reported behavior: the JSON parser accepts the duplicated property using the last value, while the YAML parser rejects it.

For the duplicate property:

"UpdateReplacePolicy": "Delete",
"UpdateReplacePolicy": "Retain"

CloudFormation/JSON.parse treats the final value as effective:

"UpdateReplacePolicy": "Retain"

Therefore, cdk diff should parse the template using the same last-value-wins behavior and continue normally—showing any
difference from the locally synthesized template—instead of crashing with Map keys must be unique.

At minimum, if CDK intentionally rejects duplicates, it should return an actionable error identifying the duplicated key and
affected resource.