Is there a way to visualize changes on nested stacks?

[andresliszt]

I know this is a common question, but I haven't found a right answer (and a fix for my issue). I'm working with python cdk and nested stack, the cdk diff is not very useful to me, because it refers to files in s3. I know when we work with nested stack they are considered as a resource (such as a lambda function is for example), but is there a real way to expand the changes in the cdk diff view?.

[~] AWS::CloudFormation::Stack Lambda.NestedStack/Lambda.NestedStackResource LambdaNestedStackLambdaNestedStackResource0E95FE80
 ├─ [~] TemplateURL
 │   └─ [~] .Fn::Join:
 │       └─ @@ -5,6 +5,6 @@
 │          [ ]     {
 │          [ ]       "Ref": "AWS::URLSuffix"
 │          [ ]     },
 │          [-]     "/foo/assets-infra/devd4aa54c1633b4aef7d726e66a9864617afad06f5292d0f610a23c1b0782d92aa.json"
 │          [+]     "/foo/assets-infra/dev597a2e25a4bffb72668f221efc50311a084b2f6a71646306eead2619b7c98c6a.json"
 │          [ ]   ]
 │          [ ] ]

[MentalOfCrow]

This was a real limitation of the older CLI, but it has since been implemented.

Recursive nested-stack diffing landed in the standalone CDK CLI in feat(toolkit-lib): changeset-based diff for nested stacks, released in CLI 2.1116.0 / toolkit-lib 1.21.0.

Upgrade the CLI (upgrading only aws-cdk-lib in the app is not enough), then use the change-set method:

npm install --save-dev aws-cdk@^2.1116.0
npx cdk --version
npx cdk diff ParentStack --method=change-set

On a current CLI, the diff implementation:

1. loads the deployed root template;
2. discovers each CDK-managed AWS::CloudFormation::Stack resource;
3. loads the deployed child template and the corresponding synthesized template from cdk.out;
4. recursively compares nested templates;
5. when using --method=change-set, creates the root change set with IncludeNestedStacks and attaches each child change set for accurate replacement information.

That means the output should now show the actual Lambda/IAM/etc. changes inside the nested stack, rather than only the changed TemplateURL asset hash shown in the question.

Use --method=change-set in review/CI when replacement accuracy matters. --method=template is faster but can over-report replacements because it only compares templates. The current official cdk diff reference documents those methods.

If the command still shows only TemplateURL, check these points:

which cdk
cdk --version
npx cdk --version

• A globally installed old cdk may be winning over the project-local npx cdk.
• The child must be a CDK-managed NestedStack. The recursive loader identifies children by their AWS::CloudFormation::Stack resource plus CDK asset metadata; an arbitrary manually authored TemplateURL cannot necessarily be mapped back to a local synthesized template.
• The caller needs permissions to list stack resources/read deployed templates and, for the change-set method, create and inspect read-only change sets. If change-set creation fails and fallback is allowed, replacement information may be less precise.

For environments stuck on an older CLI, the fallback is manual: synthesize, locate the child's *.nested.template.json in cdk.out, obtain the deployed child stack name from the parent's resources, fetch it with aws cloudformation get-template, and diff those two JSON files. But upgrading is now the cleaner solution.

So today there is a real expanded view; use CDK CLI 2.1116.0 or newer and run the parent diff with --method=change-set.

If the upgraded CLI shows the nested resources, please mark this as the accepted answer so users finding the older behavior can see that it has been fixed.