DisableApiTermination true setting is creating a new bastion during Kernel update but unable to delete the old bastion

DevOps AWS
1

We have bastion hosts managed via the CDK. A pen test required they have DisableApiTermination=true set on them, and we do that via a cloud formation override as so:

var cfnBastion = (CfnInstance) bastion.getNode().getDefaultChild().getNode().getDefaultChild();
cfnBastion.addPropertyOverride("DisableApiTermination", true);```


However, now whenever Amazon update the kernel version cloudformation decides to add a new bastion and delete the old one - which fails because of the api termination protection!

Is there a hook to allow the CDK specifically to allow api termination?
2

Also asked <https://repost.aws/questions/QU-lG74iSHTK-m3R2suxxHeg/how-can-i-enable-termination-protection-for-an-ec2-instance-managed-by-the-cdk-and-still-allow-the-cdk-to-terminate-it-in-order-to-replace-it|on AWS re:Post:>

3

Seems like you have a few options

4

Disable termination protection and then terminate

Shut down the instance from within the os

Use an asg to manage instance termination/lifecycle

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#termination-overview|https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#termination-overview

5

The DisableApiTermination attribute does not prevent Amazon EC2 Auto Scaling from terminating an instance.

6

The DisableApiTermination attribute does not prevent you from terminating an instance by initiating shutdown from the instance (using an operating system command for system shutdown) when the InstanceInitiatedShutdownBehavior attribute is set

7

I’m thinking that using an auto scaling group is the best option for a bastion, and then cdk just needs to deal with the autoscaling group configuration and the launch template

8

And it never needs to touch the instances themselves

9

But as a quick workaround you can just sequentially disable the termination protection and terminate it, but still spin up new instances with the termination protection enabled :man-shrugging:

10

Cool, thanks for the ideas