diff --git a/packages/aws-cdk/.gitignore b/packages/aws-cdk/.gitignore
index 96d158bce819f..d47d255062905 100644
--- a/packages/aws-cdk/.gitignore
+++ b/packages/aws-cdk/.gitignore
@@ -17,3 +17,7 @@ nyc.config.js
 
 !test/integ/run-wrappers/dist
 !test/integ/cli/**/*
+
+# Might be created when running regression tests.
+# But normally should be deleted after execution.
+test/integ/cli-backwards-tests-*
\ No newline at end of file
diff --git a/packages/aws-cdk/CONTRIBUTING.md b/packages/aws-cdk/CONTRIBUTING.md
index d1f98e709a1a2..6ee9632a9ef93 100644
--- a/packages/aws-cdk/CONTRIBUTING.md
+++ b/packages/aws-cdk/CONTRIBUTING.md
@@ -16,7 +16,41 @@ REQUIREMENTS
 Run:
 
 ```
-npm run integ-cli
+yarn integ-cli
+```
+
+This command runs two types of tests:
+
+#### Functional
+
+These tests simply run the local integration tests located in [`test/integ/cli`](./test/integ/cli). They test the proper deployment of stacks and in general the correctness of the actions performed by the CLI.
+
+You can also run just these tests by executing:
+
+```console
+yarn integ-cli-no-regression
+```
+
+#### Regression
+
+Validate that previously tested functionality still works in light of recent changes to the CLI. This is done by fetching the functional tests of the latest published release, and running them against the new CLI code.
+
+These tests run in two variations:
+
+- **against local framework code**
+
+  Use your local framework code. This is important to make sure the new CLI version
+  will work properly with the new framework version. 
+
+- **against latest release code**
+
+  Fetches the framework code from the latest release. This is important to make sure
+  the new CLI version does not rely on new framework features to provide the same functionality.
+
+You can also run just these tests by executing:
+
+```console
+yarn integ-cli-regression
 ```
 
 ### Init template integration tests
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index 93da8f66277ef..b9b47d5396b9d 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -17,7 +17,9 @@
     "package": "cdk-package",
     "build+test+package": "npm run build+test && npm run package",
     "build+test": "npm run build && npm test",
-    "integ-cli": "test/integ/run-against-repo test/integ/cli/test.sh",
+    "integ-cli": "scripts/integ-cli.sh",
+    "integ-cli-regression": "scripts/integ-cli-regression.sh",
+    "integ-cli-no-regression": "scripts/integ-cli-no-regression.sh",
     "integ-init": "test/integ/run-against-dist test/integ/init/test-all.sh"
   },
   "cdk-build": {
diff --git a/packages/aws-cdk/scripts/integ-cli-no-regression.sh b/packages/aws-cdk/scripts/integ-cli-no-regression.sh
new file mode 100755
index 0000000000000..f8ffea80888f7
--- /dev/null
+++ b/packages/aws-cdk/scripts/integ-cli-no-regression.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# 
+# Run only local integration tests.
+#
+set -eu
+
+scriptdir=$(cd $(dirname $0) && pwd)
+
+echo "Running local integration tests"
+./test/integ/run-against-repo test/integ/cli/test.sh
diff --git a/packages/aws-cdk/scripts/integ-cli-regression.sh b/packages/aws-cdk/scripts/integ-cli-regression.sh
new file mode 100755
index 0000000000000..7b281264a637f
--- /dev/null
+++ b/packages/aws-cdk/scripts/integ-cli-regression.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# 
+# Run only local integration tests.
+#
+set -eu
+
+scriptdir=$(cd $(dirname $0) && pwd)
+repo_root=$(realpath ${scriptdir}/..)
+
+echo "Running regression tests against local code"
+${repo_root}/test/integ/run-against-repo ${repo_root}/test/integ/test-cli-regression-against-current-code.sh
+
+echo "Running regression tests against local CLI and published framework"
+${repo_root}/test/integ/run-against-repo ${repo_root}/test/integ/test-cli-regression-against-latest-release.sh
\ No newline at end of file
diff --git a/packages/aws-cdk/scripts/integ-cli.sh b/packages/aws-cdk/scripts/integ-cli.sh
new file mode 100644
index 0000000000000..5307cf15336b7
--- /dev/null
+++ b/packages/aws-cdk/scripts/integ-cli.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# 
+# Run both local integration tests and regression tests.
+#
+set -eu
+
+scriptdir=$(cd $(dirname $0) && pwd)
+
+${scriptdir}/integ-cli-no-regression.sh
+${scriptdir}/integ-cli-regression.sh
diff --git a/packages/aws-cdk/test/integ/cli.exclusions.js b/packages/aws-cdk/test/integ/cli.exclusions.js
new file mode 100644
index 0000000000000..74726d645090e
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli.exclusions.js
@@ -0,0 +1,54 @@
+/**
+List of exclusions when running backwards compatibility tests.
+Add when you need to exclude a specific integration test from a specific version.
+
+This is an escape hatch for the rare cases where we need to introduce
+a change that breaks existing integration tests. (e.g security)
+
+For example:
+
+{
+    "test": "test-cdk-iam-diff.sh",
+    "version": "1.30.0",
+    "justification": "iam policy generation has changed in version > 1.30.0 because..."
+},
+
+*/
+const exclusions = []
+
+function getExclusion(test, version) {
+
+    const filtered = exclusions.filter(e => {
+        return e.test === test && e.version === version;
+    });
+
+    if (filtered.length === 0) {
+        return undefined;
+    }
+
+    if (filtered.length === 1) {
+        return filtered[0];
+    }
+
+    throw new Error(`Multiple exclusions found for (${test, version}): ${filtered.length}`);
+
+}
+
+module.exports.shouldSkip = function (test, version) {
+
+    const exclusion = getExclusion(test, version);
+
+    return exclusion != undefined
+
+}
+
+module.exports.getJustification = function (test, version) {
+
+    const exclusion = getExclusion(test, version);
+
+    if (!exclusion) {
+        throw new Error(`Exclusion not found for (${test}, ${version})`);
+    }
+
+    return exclusion.justification;
+}
diff --git a/packages/aws-cdk/test/integ/cli/common.bash b/packages/aws-cdk/test/integ/cli/common.bash
index ebf653fe4c9b9..9d4e507ef7d75 100644
--- a/packages/aws-cdk/test/integ/cli/common.bash
+++ b/packages/aws-cdk/test/integ/cli/common.bash
@@ -72,14 +72,14 @@ function prepare_fixture() {
     mkdir -p node_modules
 
     npm install \
-        @aws-cdk/core@^1 \
-        @aws-cdk/aws-sns@^1 \
-        @aws-cdk/aws-iam@^1 \
-        @aws-cdk/aws-lambda@^1 \
-        @aws-cdk/aws-ssm@^1 \
-        @aws-cdk/aws-ecr-assets@^1 \
-        @aws-cdk/aws-cloudformation@^1 \
-        @aws-cdk/aws-ec2@^1
+        @aws-cdk/core \
+        @aws-cdk/aws-sns \
+        @aws-cdk/aws-iam \
+        @aws-cdk/aws-lambda \
+        @aws-cdk/aws-ssm \
+        @aws-cdk/aws-ecr-assets \
+        @aws-cdk/aws-cloudformation \
+        @aws-cdk/aws-ec2
 
     echo "| setup complete at: $PWD"
     echo "| 'cdk' is: $(type -p cdk)"
diff --git a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-nested-stack-with-parameters.sh b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-nested-stack-with-parameters.sh
index f1ef447e416e4..b2389899ee71b 100755
--- a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-nested-stack-with-parameters.sh
+++ b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-nested-stack-with-parameters.sh
@@ -6,7 +6,9 @@ source ${scriptdir}/common.bash
 
 setup
 
-stack_arn=$(cdk deploy -v ${STACK_NAME_PREFIX}-with-nested-stack-using-parameters --parameters "MyTopicParam=ThereIsNoSpoon")
+# STACK_NAME_PREFIX is used in MyTopicParam to allow multiple instances
+# of this test to run in parallel, othewise they will attempt to create the same SNS topic.
+stack_arn=$(cdk deploy -v ${STACK_NAME_PREFIX}-with-nested-stack-using-parameters --parameters "MyTopicParam=${STACK_NAME_PREFIX}ThereIsNoSpoon")
 echo "Stack deployed successfully"
 
 # verify that we only deployed a single stack (there's a single ARN in the output)
diff --git a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-wildcard-with-parameters.sh b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-wildcard-with-parameters.sh
index ba5cc286416e5..30585a0ca530d 100755
--- a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-wildcard-with-parameters.sh
+++ b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-wildcard-with-parameters.sh
@@ -6,7 +6,9 @@ source ${scriptdir}/common.bash
 
 setup
 
-stack_arns=$(cdk deploy ${STACK_NAME_PREFIX}-param-test-\* --parameters "${STACK_NAME_PREFIX}-param-test-1:TopicNameParam=bazinga" --parameters "${STACK_NAME_PREFIX}-param-test-2:OtherTopicNameParam=ThatsMySpot")
+# STACK_NAME_PREFIX is used in OtherTopicNameParam to allow multiple instances
+# of this test to run in parallel, othewise they will attempt to create the same SNS topic.
+stack_arns=$(cdk deploy ${STACK_NAME_PREFIX}-param-test-\* --parameters "${STACK_NAME_PREFIX}-param-test-1:TopicNameParam=${STACK_NAME_PREFIX}bazinga" --parameters "${STACK_NAME_PREFIX}-param-test-2:OtherTopicNameParam=${STACK_NAME_PREFIX}ThatsMySpot")
 echo "Stack deployed successfully"
 
 # verify that we only deployed a single stack (there's a single ARN in the output)
diff --git a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-with-parameters.sh b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-with-parameters.sh
index 0209de3d0af9f..a0abe0ddaee9a 100755
--- a/packages/aws-cdk/test/integ/cli/test-cdk-deploy-with-parameters.sh
+++ b/packages/aws-cdk/test/integ/cli/test-cdk-deploy-with-parameters.sh
@@ -6,7 +6,9 @@ source ${scriptdir}/common.bash
 
 setup
 
-stack_arn=$(cdk deploy -v ${STACK_NAME_PREFIX}-param-test-1 --parameters "TopicNameParam=bazinga")
+# STACK_NAME_PREFIX is used in TopicNameParam to allow multiple instances
+# of this test to run in parallel, othewise they will attempt to create the same SNS topic.
+stack_arn=$(cdk deploy -v ${STACK_NAME_PREFIX}-param-test-1 --parameters "TopicNameParam=${STACK_NAME_PREFIX}bazinga")
 echo "Stack deployed successfully"
 
 # verify that we only deployed a single stack (there's a single ARN in the output)
diff --git a/packages/aws-cdk/test/integ/cli/test.sh b/packages/aws-cdk/test/integ/cli/test.sh
index 51aba309482ce..0b977b2279623 100755
--- a/packages/aws-cdk/test/integ/cli/test.sh
+++ b/packages/aws-cdk/test/integ/cli/test.sh
@@ -7,9 +7,46 @@ header CLI Integration Tests
 
 prepare_fixture
 
+current_version=$(node -p "require('${scriptdir}/../../../package.json').version")
+
+# This allows injecting different versions, not just the current one.
+# Useful when testing.
+VERSION_UNDER_TEST=${VERSION_UNDER_TEST:-${current_version}}
+
+# check if a specific test should be skiped
+# from execution in the current version.
+function should_skip {
+  test=$1
+  echo $(node -p "require('${scriptdir}/../cli.exclusions.js').shouldSkip('${test}', '${VERSION_UNDER_TEST}')")
+}
+
+# get the justification for why a test is skipped.
+# this will fail if there is no justification!
+function get_skip_jusitification {
+  test=$1
+  echo $(node -p "require('${scriptdir}/../cli.exclusions.js').getJustification('${test}', '${VERSION_UNDER_TEST}')")
+}
+
 for test in $(cd ${scriptdir} && ls test-*.sh); do
   echo "============================================================================================"
+
+  # first check this if this test should be skipped.
+  # this can happen when running in regression mode 
+  # when we introduce an intentional breaking change.
+  skip=$(should_skip ${test})
+
+  if [ ${skip} == "true" ]; then
+
+    # make sure we have a justification, this will fail if not.
+    jusitification="$(get_skip_jusitification ${test})"
+
+    # skip this specific test.
+    echo "${test} - skipped (${jusitification})"
+    continue
+  fi
+
   echo "${test}"
   echo "============================================================================================"
-  /bin/bash ${scriptdir}/${test}
+  # /bin/bash ${scriptdir}/${test}
 done
+
diff --git a/packages/aws-cdk/test/integ/run-against-dist.bash b/packages/aws-cdk/test/integ/run-against-dist.bash
index 10f70d965f37a..3e2253e145edf 100644
--- a/packages/aws-cdk/test/integ/run-against-dist.bash
+++ b/packages/aws-cdk/test/integ/run-against-dist.bash
@@ -22,17 +22,53 @@ function serve_npm_packages() {
     return
   fi
 
-  tarballs=$dist_root/js/*.tgz
+  if [ ! -z "${USE_PUBLISHED_FRAMEWORK_VERSION:-}" ]; then
 
-  log "Discovering local package names..."
-  # Read the package names from each tarball, so that we can generate
-  # a Verdaccio config that will keep each of these packages locally
-  # and not go to NPMJS for it.
-  package_names=""
-  for tgz in $tarballs; do
-    name=$(node -pe 'JSON.parse(process.argv[1]).name' "$(tar xOzf $tgz package/package.json)")
-    package_names="$package_names $name"
-  done
+    echo "Testing against latest published versions of the framework"
+
+    # when using latest published framework, only
+    # install the cli and its dependencies.
+
+    cli_root=./package  
+
+    version=$(node -p "require('${cli_root}/package.json').version")
+
+    # good lord
+    echo "Fetching CLI dependencies"
+    cli_deps=$(node -p "Object.entries(require('${cli_root}/package.json').dependencies).filter(x => x[0].includes('@aws-cdk')).map(x => x[0].replace('@aws-cdk/', '')).join(' ')")
+
+    tarballs=$dist_root/js/aws-cdk-${version}.tgz
+    package_names="aws-cdk"
+
+    for dep in ${cli_deps}; do
+      tarball=$dist_root/js/${dep}@${version}.jsii.tgz
+      package=@aws-cdk/${dep}
+      if [ ! -f ${tarball} ]; then
+        # not a jsii dependency, the tarball is different...
+        tarball=$dist_root/js/aws-cdk-${dep}-${version}.tgz        
+      fi 
+
+      tarballs="${tarballs} ${tarball}"
+      package_names="${package_names} ${package}"
+    done
+
+  else
+
+    echo "Testing against local versions of the framework"
+
+    tarballs=$dist_root/js/*.tgz
+
+    log "Discovering local package names..."
+    # Read the package names from each tarball, so that we can generate
+    # a Verdaccio config that will keep each of these packages locally
+    # and not go to NPMJS for it.
+    package_names=""
+    for tgz in $tarballs; do
+      name=$(node -pe 'JSON.parse(process.argv[1]).name' "$(tar xOzf $tgz package/package.json)")
+      package_names="$package_names $name"
+    done
+
+  fi
 
   #------------------------------------------------------------------------------
   # Start a local npm repository and install the CDK from the distribution to it
@@ -65,6 +101,7 @@ function serve_npm_packages() {
     # aws-cdk package directory.
     (cd $npmws && npm --quiet publish $tgz)
   done
+
 }
 
 function write_verdaccio_config() {
diff --git a/packages/aws-cdk/test/integ/run-wrappers/repo/npm b/packages/aws-cdk/test/integ/run-wrappers/repo/npm
index 4a49bd85621b5..e90e296bbef1d 100755
--- a/packages/aws-cdk/test/integ/run-wrappers/repo/npm
+++ b/packages/aws-cdk/test/integ/run-wrappers/repo/npm
@@ -5,7 +5,11 @@ command=$1
 
 lerna=$REPO_ROOT/node_modules/.bin/lerna
 
-if [[ "$command" == "install" || "$command" == "i" ]]; then
+if [ ! -z "${USE_PUBLISHED_FRAMEWORK_VERSION:-}" ]; then
+  # simply pass through to npm and install the published package.
+  echo "Running original NPM command since we are testing against published framework version"
+  exec $ORIGINAL_NPM "$@"
+elif [[ "$command" == "install" || "$command" == "i" ]]; then
   npmargs="install"
   shift
 
@@ -29,5 +33,3 @@ if [[ "$command" == "install" || "$command" == "i" ]]; then
 
   exec $ORIGINAL_NPM $npmargs
 fi
-
-exec $ORIGINAL_NPM "$@"
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/test-cli-regression-against-current-code.sh b/packages/aws-cdk/test/integ/test-cli-regression-against-current-code.sh
new file mode 100755
index 0000000000000..25c7988b82ee2
--- /dev/null
+++ b/packages/aws-cdk/test/integ/test-cli-regression-against-current-code.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+# 
+# Run our integration tests in regression mode against the 
+# local code of the framework and CLI.
+# 
+#   1. Download the latest released version of the aws-cdk repo.
+#   2. Copy its integration tests directory ((test/integ/cli)) here.
+#   3. Run the integration tests from the copied directory.
+#
+set -euo pipefail
+integdir=$(cd $(dirname $0) && pwd)
+
+temp_dir=$(mktemp -d)
+
+function cleanup {
+    rm -rf ${temp_dir}
+    rm -rf ${integ_under_test}
+}
+
+
+function get_latest_published_version {
+
+    # fetch the latest published version number.
+    # this is stored in the github releases under the 'latest' tag.
+
+    github_headers=""
+    if [[ "${GITHUB_TOKEN:-}" != "" ]]; then
+        github_headers="Authorization: token ${GITHUB_TOKEN}"
+    fi
+
+    out="${temp_dir}/aws-cdk-release.json"
+
+    curl -Ss --dump-header /dev/null -H "$github_headers" https://api.github.com/repos/aws/aws-cdk/releases/latest > ${out}
+    latest_version=$(node -p "require('${out}').name")
+    echo ${latest_version}
+}
+
+function download_repo {
+
+    # we need to download the repo code from GitHub in order to extract
+    # the integration tests that were present in that version of the repo.
+    # TODO - consider switching this to 'npm install', 
+    # apparently we publish the integ tests in the package.    
+    version=$1
+
+    out="${temp_dir}/.repo.tar.gz"
+
+    curl -L -o ${out} "https://github.com/aws/aws-cdk/archive/${version}.tar.gz"
+    tar --strip-components=1 -zxf ${out} -C ${temp_dir}
+    echo ${temp_dir}
+
+}
+
+# this allows injecting different versions to be treated as the baseline
+# of the regression. usually this would just be the latest published version,
+# but this can even be a branch name during development and testing.
+VERSION_UNDER_TEST=${VERSION_UNDER_TEST:-$(get_latest_published_version)}
+
+trap cleanup INT EXIT
+
+echo "Downloading aws-cdk repo version ${VERSION_UNDER_TEST}"
+temp_repo_dir="$(download_repo ${VERSION_UNDER_TEST})"
+
+# remove '/' that is prevelant in our branch names but causes
+# bad behvaior when using it as directory names.
+sanitized_version=$(sed 's/\//-/g' <<< "${VERSION_UNDER_TEST}")
+
+integ_under_test=${integdir}/cli-backwards-tests-${sanitized_version}
+rm -rf ${integ_under_test}
+echo "Copying integration tests of version ${VERSION_UNDER_TEST} to ${integ_under_test} (dont worry, its gitignored)"
+cp -r ${temp_dir}/packages/aws-cdk/test/integ/cli ${integ_under_test}
+
+echo "Running integration tests of version ${VERSION_UNDER_TEST} from ${integ_under_test}"
+VERSION_UNDER_TEST=${VERSION_UNDER_TEST} ${integ_under_test}/test.sh
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/test-cli-regression-against-latest-release.sh b/packages/aws-cdk/test/integ/test-cli-regression-against-latest-release.sh
new file mode 100755
index 0000000000000..fc3e4e3b9a859
--- /dev/null
+++ b/packages/aws-cdk/test/integ/test-cli-regression-against-latest-release.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -euo pipefail
+integdir=$(cd $(dirname $0) && pwd)
+
+# run the regular regression test but pass the env variable that will
+# eventually instruct our runners and wrappers to install the framework
+# from npmjs.org rather then using the local code.
+USE_PUBLISHED_FRAMEWORK_VERSION=True ${integdir}/test-cli-regression-against-current-code.sh
diff --git a/tools/prlint/package.json b/tools/prlint/package.json
index 30175eca33662..b51a6787878e4 100644
--- a/tools/prlint/package.json
+++ b/tools/prlint/package.json
@@ -9,6 +9,9 @@
     "name": "Amazon Web Services",
     "url": "https://aws.amazon.com"
   },
+  "scripts": {
+    "build": "echo success"
+  },
   "license": "Apache-2.0",
   "dependencies": {
     "github-api": "^3.3.0",