{
  "slug": "cdk-deploy-require-approval-adds-destructive-05c1454014fa",
  "title": "cdk deploy --require-approval adds destructive",
  "tools": [
    "cdk"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-08T00:57:21.000Z",
  "announced_at": "2026-10-08T00:57:21.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When deploying a stack that may replace, delete, or orphan resources, run `cdk deploy` with `--require-approval=destructive`. The CLI lists affected resources and requires manual confirmation before deploying them.",
    "examples": [
      "cdk deploy --require-approval=destructive <StackName>"
    ],
    "gotchas": [
      "Version: 2.1145.0",
      "--require-approval: Sets which changes require manual confirmation before deployment; `destructive` requires approval for changes that replace, delete, or orphan existing resources, including resources in nested stacks.",
      "destructive: The `--require-approval` value that requires approval for destructive changes. Changes that only broaden permissions do not require approval in this mode.",
      "<StackName>: The stack to deploy; the documented `cdk deploy` example supplies a stack name.",
      "Prerequisite: The CDK Toolkit CLI requires Node.js or another JavaScript runtime; the documented minimum supported version is Node.js v18.",
      "Docs conflict: The current AWS `cdk deploy` reference lists `any-change`, `broadening`, and `never` as valid `--require-approval` values, omitting `destructive`; the version-matched official CLI source documents `destructive`. https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-deploy.html"
    ]
  },
  "why_it_matters": "Set the approval requirement when deploying a stack that may include destructive changes.",
  "sources": [
    "https://github.com/aws/aws-cdk-cli/releases/tag/aws-cdk%40v2.1145.0",
    "https://github.com/aws/aws-cdk-cli/blob/4b8744e761dcd04d6b8b0852d23806b1ade5f3f4/packages/aws-cdk/README.md"
  ],
  "rank": 0.93047,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-154e9c61984a0688-1:rescue",
    "evidence_hash": "6b53bf9b92aa2aabc51fd1dae0c6689d4b31205728cff3d621deb066b569acfb"
  },
  "review": {
    "draft_hash": "7cce45ee94b00da8df106e9b2189b30cd30f7d2093c0becd5d74a610793e393f",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-08T00:57:21.000Z",
    "decision": "wave2a-20261017:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.69 (>= 0.6 needed)."
  }
}