feat(logs): add support for deletion protection configuration #36583

robert-hanuschke · 2026-01-05T20:50:15Z

Issue #36554

This is my very first PR for aws-cdk. Any hints on what I could do better are greatly appreciated.

I am not aware whether I would have to do something additionally to also have DeletionProtectionEnabled be available on the L1 resource CfnLogGroup, but am happy to do so if instructed.

Reason for this change

aws-logs.LogGroup did not yet support the DeletionProtectionEnabled property. This PR adds it.

Description of changes

This is a standard change to support a boolean property that was added in CloudFormation.

I added the property to the interface LogGroupProps, copying the description from the CloudFormation definition. I also extended the initialization of CfnLogGroup in the constructor. Finally, I created a unit test for the new property.

Describe any new or updated permissions being added

No further changes required.

Description of how you validated changes

Added a unit test which ran successfully.

The following are unrelated to my change, but I wanted to have them mentioned in case it points to me setting up something wrongly in my local environment and introducing errors down the line.

Following the commands in CONTRIBUTING.MD:

The command npx lerna run build --skip-nx-cache had 16/17 targets succeed, with the one failing being:

aws-cdk/tools/@aws-cdk/spec2cdk/lib/cdk/typedefinition-struct.ts
9:1 error ./cdk import should occur before import of ./cloudformation-mapping import/order

Likewise, yarn build in the packages/aws-cdk-lib folder failed with messages like

/aws-cdk/packages/aws-cdk-lib/aws-eks/test/kubectl-provider.test.ts
5:1 error ./util import should occur before import of ../../assertions import/order

/aws-cdk/packages/aws-cdk-lib/aws-kinesisfirehose/lib/s3-bucket.ts
7:1 error ./private/helpers import should occur before import of ./record-format import/order

but yarn test completed successfully

Checklist

My code adheres to the CONTRIBUTING GUIDE and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

robert-hanuschke · 2026-01-05T21:23:06Z

I'm trying to run the integration test according to INTEGRATION_TESTS.md to also create the snapshot, but unfortunately don't get it done successfully.

test]$ yarn integ --update-on-failed integ.loggroup-deletionprotection.js
yarn run v1.22.22
$ integ-runner --unstable=toolkit-lib-engine --language javascript --update-on-failed integ.loggroup-deletionprotection.js
No such integ test: integ.loggroup-deletionprotection.js
Available tests: aws-ec2/test/integ.placement-group.js aws-events-targets/test/batch/integ.job-definition-events.js aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js aws-stepfunctions-tasks/test/batch/integ.submit-job.js pipelines/test/integ.newpipeline-with-file-system-locations.js

Verifying integration test snapshots...

Snapshot Results:

Tests: 0 passed, 0 total

Running integration tests for failed tests...

Running in parallel across regions: us-east-1, us-east-2, us-west-2

Test Results:

Tests: 0 passed, 0 total
Done in 0.39s.

Appreciate any help.

badmintoncryer · 2026-01-06T00:51:57Z

@robert-hanuschke Are you specifying the test file accurately using a relative path from the current directory?

robert-hanuschke · 2026-01-06T06:19:32Z

I am in the test directory of the module, the .ts file is there, for the integ call I just replace the ending with .js as I understood the instructions

test]$ pwd
<parent_dir>/aws-cdk/packages/@aws-cdk-testing/framework-integ/test/aws-logs/test
test]$ ls | grep deletion
integ.loggroup-deletionprotection.ts
test]$ yarn integ --update-on-failed integ.loggroup-deletionprotection.js
yarn run v1.22.22
$ integ-runner --unstable=toolkit-lib-engine --language javascript --update-on-failed integ.loggroup-deletionprotection.js
No such integ test: integ.loggroup-deletionprotection.js
Available tests: aws-ec2/test/integ.placement-group.js aws-events-targets/test/batch/integ.job-definition-events.js aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js aws-stepfunctions-tasks/test/batch/integ.submit-job.js pipelines/test/integ.newpipeline-with-file-system-locations.js

Verifying integration test snapshots...

Snapshot Results:

Tests: 0 passed, 0 total

Running integration tests for failed tests...

Running in parallel across regions: us-east-1, us-east-2, us-west-2

Test Results:

Tests: 0 passed, 0 total
Done in 0.39s.

dalatrex2 · 2026-01-06T19:18:16Z

@robert-hanuschke you have to build the integ framework first, execute this command at the root of the repo npx lerna run build --scope=@aws-cdk-testing/framework-integ

after this is done you should be able to run yarn integ --update-on-failed integ.loggroup-deletionprotection.js

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

robert-hanuschke · 2026-01-06T21:29:38Z

@dalatrex2 thank you!

This was connected to the errors I reported in the initial PR text. First, the lerna command failed simiarly. I now found out that I was on node 25 in my terminal. After setting it to the lts version, the commands succeed.
Sorry for the confusion caused. Rocky first PR, I'll work hard to make the next ones smoother 🙂

My command outputs look fine - the rosetta script is complaining about the unrelated module aws-amplify-alpha

yarn test aws-logs

yarn run v1.22.22
$ jest aws-logs
PASS aws-logs/test/pattern.test.ts (8.436 s)
PASS aws-logs/test/query-definition.test.ts (9.056 s)
PASS aws-logs-destinations/test/kinesis.test.ts (9.009 s)
PASS aws-logs/test/metricfilter.test.ts (9.167 s)
PASS aws-logs/test/log-retention.test.ts (10.018 s)
PASS aws-logs/test/policy.test.ts
PASS aws-logs/test/destination.test.ts
PASS aws-logs/test/subscriptionfilter.test.ts
PASS aws-logs/test/logstream.test.ts
PASS aws-logs/test/transformer.test.ts (11.032 s)
PASS aws-logs-destinations/test/firehose.test.ts (11.084 s)
PASS aws-logs-destinations/test/lambda.test.ts
PASS aws-logs/test/loggroup.test.ts (12.948 s)

Coverage summary
Statements : 47.23% ( 10460/22143 )
Branches : 24.11% ( 2070/8584 )
Functions : 28.71% ( 1325/4614 )
Lines : 48.03% ( 10109/21044 )

Jest: "global" coverage threshold for statements (55%) not met: 47.23%
Jest: "global" coverage threshold for branches (35%) not met: 24.11%

Test Suites: 13 passed, 13 total
Tests: 140 passed, 140 total
Snapshots: 0 total
Time: 14.72 s
Ran all test suites matching /aws-logs/i.
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

yarn integ test/aws-logs/test/integ.loggroup-deletionprotection.js --update-on-failed

yarn run v1.22.22
$ integ-runner --unstable=toolkit-lib-engine --language javascript test/aws-logs/test/integ.loggroup-deletionprotection.js --update-on-failed

Verifying integration test snapshots...

UNCHANGED aws-logs/test/integ.loggroup-deletionprotection 2.691s

Snapshot Results:

Tests: 1 passed, 1 total

Running integration tests for failed tests...

Running in parallel across regions: us-east-1, us-east-2, us-west-2

Test Results:

Tests: 0 passed, 0 total
Done in 3.49s.

/bin/bash ./scripts/run-rosetta.sh

Collecting package list...
💎 Extracting code samples
yarn run v1.22.22
$ jsii-rosetta extract --compile --verbose --compress-tablet --cache HOME_DIR/.s3buildcache/rosetta-cache.tabl.json REDACTED_DIR/aws-cdk/packages/@aws-cdk/cx-api REDACTED_DIR/aws-cdk/packages/aws-cdk-lib REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-codestar-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-route53resolver-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-s3objectlambda-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/integ-tests-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/region-info REDACTED_DIR/aws-cdk/packages/@aws-cdk/app-staging-synthesizer-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-amplify-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-applicationsignals-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-apprunner-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-bedrock-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-cloud9-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-ec2-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-eks-v2-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-elasticache-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-gamelift-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-glue-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-imagebuilder-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-iot-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-iotevents-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-ivs-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-kinesisanalytics-flink-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-lambda-go-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-lambda-python-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-location-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-msk-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-neptune-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-pipes-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-redshift-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-s3tables-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-sagemaker-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-servicecatalogappregistry-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/mixins-preview REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-bedrock-agentcore-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-iot-actions-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-iotevents-actions-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-pipes-enrichments-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-pipes-sources-alpha REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-pipes-targets-alpha
[jsii-rosetta] [INFO] Loading 40 assemblies
[jsii-rosetta] [ERROR] Expected to find .jsii file in REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-amplify-alpha, but no such file found
[jsii-rosetta] [ERROR] Error: Expected to find .jsii file in REDACTED_DIR/aws-cdk/packages/@aws-cdk/aws-amplify-alpha, but no such file found
at findAssemblyFile (REDACTED_DIR/aws-cdk/node_modules/@jsii/spec/lib/assembly-utils.js:32:15)
at loadAssembly (REDACTED_DIR/aws-cdk/node_modules/jsii-rosetta/lib/jsii/assemblies.js:56:61)
at Array.map ()
at loadAssemblies (REDACTED_DIR/aws-cdk/node_modules/jsii-rosetta/lib/jsii/assemblies.js:52:30)
at extractSnippets (REDACTED_DIR/aws-cdk/node_modules/jsii-rosetta/lib/commands/extract.js:29:56)
at REDACTED_DIR/aws-cdk/node_modules/jsii-rosetta/lib/main.js:264:51
at Object.handler (REDACTED_DIR/aws-cdk/node_modules/jsii-rosetta/lib/main.js:409:9)
at REDACTED_DIR/aws-cdk/node_modules/yargs/build/index.cjs:1:8993
at j (REDACTED_DIR/aws-cdk/node_modules/yargs/build/index.cjs:1:4956)
at _.handleValidationAndGetResult (REDACTED_DIR/aws-cdk/node_modules/yargs/build/index.cjs:1:8962)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

real 0m0,973s
user 0m0,828s
sys 0m0,197s

yarn test (shortened)

....

PASS aws-logs/test/loggroup.test.ts (6.194 s)

Coverage summary
Statements : 89.56% ( 56191/62740 )
Branches : 89.18% ( 21398/23992 )
Functions : 80.65% ( 10558/13090 )
Lines : 94.83% ( 54133/57080 )

Test Suites: 824 passed, 824 total
Tests: 3 skipped, 16746 passed, 16749 total
Snapshots: 19 passed, 19 total
Time: 885.453 s
Ran all test suites.
Done in 886.21s.

github-actions · 2026-01-12T20:12:27Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-01-12T20:12:30Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

ozelalisen

Thanks for your first contribution, left some minor comments, your implementation is correct, adjusted pr title as this will be shown in the changelog and commit, which should include module that you are adding and descriptive enough

packages/aws-cdk-lib/aws-logs/README.md

packages/aws-cdk-lib/aws-logs/lib/log-group.ts

...ges/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.loggroup-deletionprotection.ts

Pull request has been modified.

Co-authored-by: Alisen Ozel <74890690+ozelalisen@users.noreply.github.com>

robert-hanuschke · 2026-01-16T21:24:09Z

Thank you for the review @ozelalisen !
I accepted all your code suggestions and deleted the unnecessary synth line.

I copied that over as I perceived it to be a pattern, e.g. in integ.loggroup-grantread.ts and integ.log-retention.ts. For my understanding - the synth line is superfluous there too, then?

ozelalisen · 2026-01-19T10:08:27Z

Those tests might have the old patterns, so currently we do not need this. Yes, it is not needed there as well

ozelalisen

LGTM, thanks for addressing comments!

mergify · 2026-01-19T10:48:01Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-01-19T10:48:10Z

mergify · 2026-01-19T11:17:37Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-01-19T11:17:51Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

robert added 2 commits January 5, 2026 20:25

feat: add deletionProtectionEnabled to aws-logs.LogGroup

7cd443b

add unit test for aws-logs.LogGroup.deletionProtectionEnabled

9f33244

aws-cdk-automation requested a review from a team January 5, 2026 20:50

github-actions bot added effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels Jan 5, 2026

aws-cdk-automation previously requested changes Jan 5, 2026

View reviewed changes

robert added 2 commits January 5, 2026 22:01

add description of deletionProtectionEnabled

9b85e8d

add integration test for deletionProtectionEnabled

854afa8

pahud mentioned this pull request Jan 5, 2026

CI Pending Approval - 22 PR(s) pahud/aws-cdk#11

Open

robert added 2 commits January 6, 2026 22:23

add missing trailing comma

a5f911f

add integration test generated files

9d27477

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 12, 2026

ozelalisen changed the title ~~feat: add support for aws-logs.LogGroup.deletionProtectionEnabled~~ feat(logs): add support for deletion protection configuration Jan 13, 2026

ozelalisen self-assigned this Jan 13, 2026

ozelalisen previously requested changes Jan 13, 2026

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 13, 2026

Merge branch 'aws:main' into issue-36554

ce76a0b

robert-hanuschke and others added 2 commits January 16, 2026 21:52

Apply suggestions from code review

08d7267

Co-authored-by: Alisen Ozel <74890690+ozelalisen@users.noreply.github.com>

removed unnecessary synth

a36927d

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 16, 2026

ozelalisen approved these changes Jan 19, 2026

View reviewed changes

Merge branch 'main' into issue-36554

6d45573

mergify bot merged commit c4d1389 into aws:main Jan 19, 2026
22 of 23 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Jan 19, 2026

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 19, 2026

feat(logs): add support for deletion protection configuration #36583

feat(logs): add support for deletion protection configuration #36583

Uh oh!

Conversation

robert-hanuschke commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue #36554

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robert-hanuschke commented Jan 5, 2026

Uh oh!

badmintoncryer commented Jan 6, 2026

Uh oh!

robert-hanuschke commented Jan 6, 2026

Uh oh!

dalatrex2 commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robert-hanuschke commented Jan 6, 2026

yarn test aws-logs

yarn integ test/aws-logs/test/integ.loggroup-deletionprotection.js --update-on-failed

/bin/bash ./scripts/run-rosetta.sh

yarn test (shortened)

Uh oh!

github-actions bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ozelalisen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

robert-hanuschke commented Jan 16, 2026

Uh oh!

ozelalisen commented Jan 19, 2026

Uh oh!

ozelalisen left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Jan 19, 2026

Uh oh!

mergify bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify bot commented Jan 19, 2026

Uh oh!

Uh oh!

github-actions bot commented Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

robert-hanuschke commented Jan 5, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

dalatrex2 commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 12, 2026 •

edited

Loading

github-actions bot commented Jan 12, 2026 •

edited

Loading

mergify bot commented Jan 19, 2026 •

edited

Loading