EFS: It forces me to replace the EFS which have files

[tom10271]

Describe the bug

I have upgraded from CDK v1 to v2. I have fixed import paths in files only. My EFS has not specified encryted.

When I run cdk diff, this was returned:

[~] AWS::EFS::FileSystem My worker EFS MyworkerEFSC4FFD393 replace
 └─ [+] Encrypted (requires replacement)
     └─ true

When I explicitly set it to false, it still ask for a EFS replacement.

[~] AWS::EFS::FileSystem Odoo worker EFS OdooworkerEFSC4FFD393 replace
 └─ [+] Encrypted (requires replacement)
     └─ false

Expected Behavior

It should not replace my EFS if I set to false as it was not enabled at all.

Current Behavior

Either true or false for Encrypted it will still going to replace my EFS.

Reproduction Steps

Create EFS in v1

    new FileSystem(scope, 'My worker EFS', {
        vpc: NETWORKING.VPC,

        // Updating this property will replace the file system.
        performanceMode: PerformanceMode.GENERAL_PURPOSE,
        vpcSubnets: {
            subnets: [NETWORKING.PUBLIC_SUBNET_2B]
        },
        enableAutomaticBackups: true,
        removalPolicy: RemovalPolicy.RETAIN,
        lifecyclePolicy: LifecyclePolicy.AFTER_90_DAYS,
    });

Then run cdk diff

Possible Solution

You fix it :)

Additional Information/Context

No response

CDK CLI Version

2.20.0 (build 738ef49)

Framework Version

No response

Node.js Version

v14.19.1

OS

macOS 12.3.1 (21E258)

Language

Typescript

Language Version

~3.9.7

Other information

No response

[peterwoodworth]

Hey @tom10271, going to migrate this to a discussion.

Adding encryption was part of our graduating this module to stable. This was back a year ago, so before we released v2. What we did to prevent breaking existing users was to hide this behind a feature flag.

However, CDK v2 removed most feature flags. These are the only ones we still support in v2. I believe that your best path forward here is to remove the encryption property with an escape hatch

const cfnFs = fs.node.defaultChild as CfnFileSystem;
cfnFs.addPropertyDeletionOverride('Encrypted')

[skinny85]

Why not just pass the encrypted property as false?

[peterwoodworth]

This triggers resource replacement, which I assume the customer wants to avoid. Even though it wouldn't actually affect the resource at all, CloudFormation detects that the property did change from undefined to false

[skinny85]

Ah. Makes sense!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.