[9pace]

Fixes #2036

This covers a regression described in the above issue: cdk diff says "There were no differences" when a JSON string built with an intrinsic only gains a key.

For reference I will take the following example:

const value = { stack: Aws.STACK_NAME, a: '1', b: '2' }; // b is the new key
new ssm.StringParameter(this, 'Param', { stringValue: this.toJsonString(value) });

Value:
  Fn::Join: ["", ['{"stack":"', {Ref: AWS::StackName}, '","a":"1","b":"2"}']]   # was '","a":"1"}'

The change-set diff compares the two templates, then asks CloudFormation which resources will change and trusts its answer. Since #1668 it asks with IncludePropertyValues, so that it can also show changes that only happen at deploy time (#641). The same change set described both ways (output trimmed):

## IncludePropertyValues=False
   Status=CREATE_COMPLETE StatusReason=None
   Changes=[('Modify', 'Param165332EC', ['Value'])]
## IncludePropertyValues=True
   Status=CREATE_COMPLETE StatusReason=None
   Changes=[]

With IncludePropertyValues, CloudFormation leaves the change out and gives no warning. An internal ticket tracks this with CloudFormation. It happens whenever a JSON string only gains a key, only reorders its keys, or only changes whitespace. If the same resource has another change too, CloudFormation still lists the resource, but only with the other change. The JSON property is missing from it.

The diff then hides the change because of a rule in the merger:
a property change that the change set does NOT contain is treated as unchanged when the value contains Ref, Fn::* or {{resolve:...}}.

This rule is there for rewrites that resolve to the same value, such as a Fn::Join turned into an equivalent Fn::Sub, which CloudFormation correctly leaves out. #1951 already keeps static values; for example a static JSON string that gains a key is still shown. In the example, if the Ref resolved to a different value as well, an existing key would change, CloudFormation would list the resource, and the diff would show it.

These cases were shown up to 2.1128.1, the last release before #1668. Back then the merger already treated a change missing from the change set as unchanged (until #1951 even for static values), but the diff described the change set without IncludePropertyValues, and CloudFormation includes these changes in a description without it.

Change to the JSON	Example	2.1145.0	This PR
gains a key with a fixed value	b: '2' added	hidden	shown
gains a key with a token value	region: Aws.REGION added	hidden	shown
keys reordered	{ a, stack } instead of { stack, a }	hidden	shown
an existing value changes	a: '2'	shown	shown
rewritten to the same resolved value	Fn::Join to Fn::Sub	hidden	hidden

The fix leaves the merger's behaviour as it is. Before the diff uses the change set described with IncludePropertyValues, it checks whether the merger would treat any template difference as unchanged because the change set leaves it out. Only then is the change set described again without IncludePropertyValues, and what the first description left out is merged back in (mergeDescriptions from #1785). A rewrite like the last row is missing from both descriptions, so it stays hidden.

The check has to run in ChangeSetDescriber because cloudformation-diff makes no AWS calls, and cdk diff deletes the change set before it calls fullDiff. The second DescribeChangeSet only happens when a template difference would otherwise be hidden.

Not covered here:

• The cdk deploy --require-approval diff has been broken the same way since fix: change-set diff can miss changes to JSON-typed properties #1785, I have separated it out to be fixed in fix(toolkit-lib): deploy approval diff hides an added key in a JSON string with an intrinsic #2045, on top of this one.
• A change that only happens at deploy time ((diff): changeset-based cdk diff not showing changes caused by SSM parameters, but appear in CloudFormation UI changeset info #641) and only gains a key is still not shown, the same as before 2.1129.0.
• Nested stacks in toolkit-lib's diff (the CLI diffs nested stacks from their templates only). Their change sets are described without this check, and only after the root change set has been deleted, which removes them a few seconds later.

The integ tests added cover every row of the table, and a key added while the parameter's description also changes. Rows 1, 2 and 3 and that last case fail as expected on 2.1145.0.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None