Question

A team uses AWS CDK to define two stacks in the same app: a NetworkStack that creates a VPC and exports a shared security group, and an AppStack that references that security group via a CDK cross-stack reference (the security group object is passed directly between stack constructs). During a routine change, a developer removes the security group usage from AppStack and redeploys, intending to later delete the security group entirely from NetworkStack. The AppStack deployment succeeds, but when they subsequently try to delete the security group from NetworkStack, the NetworkStack update fails. What is the MOST likely cause and correct approach?

Accepted Answer

The failure occurs because CloudFormation will not delete an exported value that is still imported by another stack; deploying both stacks together with `cdk deploy --all` lets CDK sequence the AppStack update (dropping the import) before the NetworkStack export removal, resolving the dependency safely.

Answer

CDK automatically manages the CloudFormation Export/Import created by the cross-stack reference; the developer must deploy AppStack (removing the import) BEFORE deploying NetworkStack (removing the export), which was done, so the failure indicates a manual template edit is required.

Answer

CDK cross-stack references create a CloudFormation Export in NetworkStack consumed by an Import in AppStack; a stale export can still be referenced. The developer should ensure AppStack no longer imports the value, deploy AppStack first, then deploy NetworkStack to remove the export and the resource — CDK orchestrates this ordering when both stacks are deployed together.

Answer

Cross-stack references in CDK use SSM Parameter Store rather than CloudFormation Exports, so the deletion failure is caused by a leftover parameter; the developer should manually delete the SSM parameter before redeploying NetworkStack.