Cfn-python-lint: Add validation check for UpdateReplacePolicy

[ohshazbot]

cfn-lint version: 0.22.4

Description of issue.
After getting bit by a missing UpdateReplacePolicy while adding a ddb local index, I think it would be good to include a check about including an UpdateReplacePolicy, similar to what is done for DeletionPolicy. These sort of warnings, at least in my experience, are great for pointing out features/practices that are easy to miss when getting started, but could save a whole lot of grief if configured.

Cfn-lint uses the CloudFormation Resource Specifications as the base to do validation. These files are included as part of the application version. Please update to the latest version of cfn-lint or update the spec files manually (cfn-lint -u)

[PatMyron]

@ohshazbot were you thinking about warning for every resource type or specific resource types?

I agree that replacement is the most common unintended consequence through CloudFormation, and UpdateReplacePolicy awareness could definitely improve

As I mentioned here, none of the current UpdateReplacePolicy options are ideal for preventing accidental replacements, and changesets/stack policies are still currently necessary to ensure a resource isn't replaced and can still be managed through CloudFormation

I'm thinking there are specific resource types, especially stateful resources like databases, where people care much more about preventing replacement but I do wonder how feasible it would be to maintain that list @kddejong

[ohshazbot]

Hmm, hadn't put a lot of thought into it, but I would say specific resource types are more important, anything that holds data.

Though I think my thought when I originally made this was just warn on absence of UpdateReplacePolicy, regardless of value, to make users aware of it (or to help flag new additions where this was not considered)

[PatMyron]

@ohshazbot maybe instead of warning on every single resource missing UpdateReplacePolicy, warning on templates that have no instances of UpdateReplacePolicy or templates containing specific resource types that have no instances of UpdateReplacePolicy?

That could cut down on some noise and provide a more generally useful warning. We could also have a noisier Informational level rule as well

[benbridts]

Or warn for a resource with a DeletionPolicy but no UpdateReplacePolicy?

[PatMyron]

@ikben definitely think that'd be a great warning-level rule

Do you think the reverse makes sense as well? Warning if UpdateReplacePolicy is set but DeletionPolicy isn't?

[benbridts]

Probably? You'd might like to have a UpdateReplacePolicy, but no DeletionPolicy because Deletion is a more explicit action than a UpdateReplacement (aka it's easier to trigger an UpdateReplacement by accident). But being explicit about those cases isn't bad either. Adding DeletionPolicy: Delete would make the warning disappear.

[PatMyron]

@ikben agreed that update replacement is easier to trigger by accident. One likely accidental deletion case I'm thinking about is due to condition value changes. Seems more likely to trigger than accidentally removing the resource from the template entirely