Cloudformation Termination Protection and Confusion with setDefaultRemovalPolicy about sst HOT 3 OPEN

Hmm let me check with the team.

What's the core issue here? Somebody accidentally runs sst remove on a prod stage? And you want that command to fail?

from sst.

Many thanks! Its more the interraction with Cloudformation that feels at issue here, a key Lambda was deleted from a stack during a Rollback and subsequent Rollback Failure. We followed this SST docs example until this incident, but this example does not explicately set any removal policy on production, where Cloudformation's default behaviour for having no removal policy is to follow the destroy policy.

Whole stack termination protection appears possible to set with CDK so we should be fine there, but we want to know what happens in SST when setDefaultRemovalPolicy is not set at all. If there is undocumented issues with unset being the same as destroy we should clear this up, or setDefaultRemovalPolicy should be required in some way so that there is no implicate behaviour for not setting this.

from sst.

So this is the policy on remove if nothing is set: https://docs.sst.dev/advanced/removal-policy#retained-resources

Does that make sense?

from sst.