{"action":"closed","issue":{"url":"https://api.github.com/repos/awslabs/aws-cdk/issues/978","repository_url":"https://api.github.com/repos/awslabs/aws-cdk","labels_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/978/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/978/comments","events_url":"https://api.github.com/repos/awslabs/aws-cdk/issues/978/events","html_url":"https://github.com/awslabs/aws-cdk/issues/978","id":372311127,"node_id":"MDU6SXNzdWUzNzIzMTExMjc=","number":978,"title":"toolkit: surface potentially risky changes and enforce confirmation","user":{"login":"eladb","id":598796,"node_id":"MDQ6VXNlcjU5ODc5Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/598796?v=4","gravatar_id":"","url":"https://api.github.com/users/eladb","html_url":"https://github.com/eladb","followers_url":"https://api.github.com/users/eladb/followers","following_url":"https://api.github.com/users/eladb/following{/other_user}","gists_url":"https://api.github.com/users/eladb/gists{/gist_id}","starred_url":"https://api.github.com/users/eladb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eladb/subscriptions","organizations_url":"https://api.github.com/users/eladb/orgs","repos_url":"https://api.github.com/users/eladb/repos","events_url":"https://api.github.com/users/eladb/events{/privacy}","received_events_url":"https://api.github.com/users/eladb/received_events","type":"User","site_admin":false},"labels":[{"id":1126257578,"node_id":"MDU6TGFiZWwxMTI2MjU3NTc4","url":"https://api.github.com/repos/awslabs/aws-cdk/labels/ui","name":"ui","color":"c10195","default":false},{"id":988150410,"node_id":"MDU6TGFiZWw5ODgxNTA0MTA=","url":"https://api.github.com/repos/awslabs/aws-cdk/labels/%E2%8F%AF%20ops-readiness","name":"⏯ ops-readiness","color":"c96334","default":false},{"id":1023659198,"node_id":"MDU6TGFiZWwxMDIzNjU5MTk4","url":"https://api.github.com/repos/awslabs/aws-cdk/labels/%F0%9F%91%AE%E2%80%8D%E2%99%82%EF%B8%8F%20security-issue","name":"👮‍♂️ security-issue","color":"33c46d","default":false},{"id":1118286494,"node_id":"MDU6TGFiZWwxMTE4Mjg2NDk0","url":"https://api.github.com/repos/awslabs/aws-cdk/labels/%F0%9F%9B%A0%20toolkit","name":"🛠 toolkit","color":"c1a203","default":false}],"state":"closed","locked":false,"assignee":{"login":"rix0rrr","id":524162,"node_id":"MDQ6VXNlcjUyNDE2Mg==","avatar_url":"https://avatars2.githubusercontent.com/u/524162?v=4","gravatar_id":"","url":"https://api.github.com/users/rix0rrr","html_url":"https://github.com/rix0rrr","followers_url":"https://api.github.com/users/rix0rrr/followers","following_url":"https://api.github.com/users/rix0rrr/following{/other_user}","gists_url":"https://api.github.com/users/rix0rrr/gists{/gist_id}","starred_url":"https://api.github.com/users/rix0rrr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rix0rrr/subscriptions","organizations_url":"https://api.github.com/users/rix0rrr/orgs","repos_url":"https://api.github.com/users/rix0rrr/repos","events_url":"https://api.github.com/users/rix0rrr/events{/privacy}","received_events_url":"https://api.github.com/users/rix0rrr/received_events","type":"User","site_admin":false},"assignees":[{"login":"rix0rrr","id":524162,"node_id":"MDQ6VXNlcjUyNDE2Mg==","avatar_url":"https://avatars2.githubusercontent.com/u/524162?v=4","gravatar_id":"","url":"https://api.github.com/users/rix0rrr","html_url":"https://github.com/rix0rrr","followers_url":"https://api.github.com/users/rix0rrr/followers","following_url":"https://api.github.com/users/rix0rrr/following{/other_user}","gists_url":"https://api.github.com/users/rix0rrr/gists{/gist_id}","starred_url":"https://api.github.com/users/rix0rrr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rix0rrr/subscriptions","organizations_url":"https://api.github.com/users/rix0rrr/orgs","repos_url":"https://api.github.com/users/rix0rrr/repos","events_url":"https://api.github.com/users/rix0rrr/events{/privacy}","received_events_url":"https://api.github.com/users/rix0rrr/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-10-21T12:44:35Z","updated_at":"2018-12-10T13:36:00Z","closed_at":"2018-12-10T13:36:00Z","author_association":"CONTRIBUTOR","body":"\"cdk diff\" should surface to the user any changes to IAM permissions in a very explicit way. Users should be able to see exactly which permissions were added or removed from their app.\r\n\r\nThis is particularly important when using 3rd party construct libraries, it's important to ensure that any permissions changes are clearly visible to the user.\r\n\r\nWe should also consider requiring an explicit interactive approval for permission changes in \"cdk deploy\". Something like:\r\n\r\n```s\r\n$ cdk deploy\r\nPlease confirm that the following permissions will be added:\r\n- sqs:SendMessage on <ARN> will be granted to <PRINCIPAL>\r\n- dynamodb:PutObject on <ARN> will be granted to <PRINCIPAL>\r\nPlease confirm (Y/N) or use -y for non-interactive experience [N]: \r\n```"}}
{"actor":{"display_login":"rix0rrr"}}