fix(iam): allow intrinsic functions in deletion policy

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsic-deletion-policy.json

@@ -0,0 +1,53 @@
+{
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Transform": "AWS::LanguageExtensions",
+    "Parameters": {
+        "Stage": {
+            "Type": "String",
+            "AllowedValues": [
+                "Prod",
+                "Staging",
+                "Dev"
+            ]
+        }
+    },
+    "Conditions": {
+        "IsProd": {
+            "Fn::Equals": [
+                {
+                    "Ref": "Stage"
+                },
+                "Prod"
+            ]
+        }
+    },
+    "Resources": {
+        "Table": {
+            "Type": "AWS::DynamoDB::Table",
+            "Properties": {
+                "KeySchema": [{
+                    "AttributeName": "primaryKey",
+                    "KeyType": "HASH"
+                }],
+                "AttributeDefinitions": [{
+                        "AttributeName": "primaryKey",
+                        "AttributeType": "S"
+                }]
+            },
+            "DeletionPolicy": {
+                "Fn::If": [
+                    "IsProd",
+                    "Retain",
+                    "Delete"
+                ]
+            },
+            "UpdateReplacePolicy": {
+                "Fn::If": [
+                    "IsProd",
+                    "Retain",
+                    "Delete"
+                ]
+            }
+        }
+    }
+}

packages/aws-cdk-lib/cloudformation-include/test/valid-templates.test.ts

@@ -262,6 +262,14 @@ describe('CDK Include', () => {
     );
   });
 
+  test('can ingest a template with intrinsic functions used in deletion policy', () => {
+    includeTestTemplate(stack, 'intrinsic-deletion-policy.json');
+
+    Template.fromStack(stack).templateMatches(
+      loadTestFileToJsObject('intrinsic-deletion-policy.json'),
+    );
+  });
+
   test('can ingest a JSON template with string-form Fn::GetAtt, and output it unchanged', () => {
     includeTestTemplate(stack, 'get-att-string-form.json');
 

packages/aws-cdk-lib/core/lib/helpers-internal/cfn-parse.ts

@@ -466,14 +466,21 @@ export class CfnParser {
   }
 
   private parseDeletionPolicy(policy: any): CfnDeletionPolicy | undefined {
+    if (policy === undefined || policy === null) {
+      return undefined;
+    }
+    const isIntrinsic = this.looksLikeCfnIntrinsic(policy) !== undefined;
     switch (policy) {
-      case null: return undefined;
-      case undefined: return undefined;
       case 'Delete': return CfnDeletionPolicy.DELETE;
       case 'Retain': return CfnDeletionPolicy.RETAIN;
       case 'Snapshot': return CfnDeletionPolicy.SNAPSHOT;
       case 'RetainExceptOnCreate': return CfnDeletionPolicy.RETAIN_EXCEPT_ON_CREATE;
-      default: throw new Error(`Unrecognized DeletionPolicy '${policy}'`);
+      default: if (isIntrinsic) {
+        policy = this.parseValue(policy);
+        return policy;
+      } else {
+        throw new Error(`Unrecognized DeletionPolicy '${policy}'`);
+      }
     }
   }