feat(appconfig): environment deletion protection

[badmintoncryer]

Issue # (if applicable)

None

Reason for this change

AWS AppConfig environment supports deletion protection and this feature is not configurable from AWS CDK.

Description of changes

• Add DeletionProtectionCheck enum
• Add deletionProtectionCheck prop to EnvironmentOption

There are two entities, EnvironmentOptions and EnvironmentProps, where EnvironmentProps is designed as an extension of EnvironmentOptions with the addition of an application prop.

export interface EnvironmentProps extends EnvironmentOptions {
  /**
   * The application to be associated with the environment.
   */
  readonly application: IApplication;
}

abstract class ApplicationBase extends cdk.Resource implements IApplication, IExtensible {
  public addEnvironment(id: string, options: EnvironmentOptions = {}): IEnvironment {
    return new Environment(this, id, {
      application: this,
      ...options,
    });
  }

Therefore, the current argument addition has also been made to EnvironmentOptions.

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 66.96%. Comparing base (dd6a2f4) to head (a076e34).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32737   +/-   ##
=======================================
  Coverage   66.96%   66.96%           
=======================================
  Files         329      329           
  Lines       18667    18667           
  Branches     3260     3260           
=======================================
  Hits        12501    12501           
  Misses       5839     5839           
  Partials      327      327           

Flag	Coverage Δ
suite.unit	66.96% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	80.71% <ø> (ø)
packages/aws-cdk-lib/core	82.09% <ø> (ø)

[mazyu36]

Thank you for the contribution.
I've left some comments.

I'm not very familiar with this property, so please correct me if I'm wrong.

[mazyu36]

Very very nit:

Suggested change

	- ACCOUNT_DEFAULT: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.
	- ACCOUNT_DEFAULT: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the UpdateAccountSettings API.

[mazyu36]

I understand this sentence means the following, is that correct?

• Use account-level settings when ACCOUNT_DEFAULT is set.
• If users want to enable account-level deletion protection, they need to use the UpdateAccountSettings API via AWS CLI or another tool.

The current explanation seems to be taken from the docs, but I think an explanation like the one below would be clearer. What do you think?

The default setting, which uses account-level deletion protection. To configure account-level deletion protection, use the UpdateAccountSettings API.

[mazyu36]

Just to clarify, if deletion protection is applied to an environment, is the protected resource the environment itself or a configuration set?

I'm not sure if "configuration profile" is the correct term in this context.

[mazyu36]

In my understanding, this enum is required for the configuration profile.

Therefore, I think it would be better to separate this enum into another file (e.g., util.ts).

[badmintoncryer]

@mazyu36 Thank you very much for your review! All of your comments are spot-on and provide appropriate feedback.

I've addressed all the discussions.

[mazyu36]

Thank you for the modification.
Just two more comments.

[badmintoncryer]

@mazyu36 Thank you for your reveiw! And I'm sorry for my rough edits.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 4a6f4ca
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mazyu36]

Thanks! LGTM