Repository navigation
Full AWS coverage for Radius Bicep #13455
Description
Overview of feature request
Radius should deploy every AWS resource type that people still use, from Bicep, and redeploying a template should behave the way it does for Azure resources.
Today Radius deploys AWS resources through the AWS Cloud Control API. Most problems users hit come from how Radius uses that API, not from AWS:
- Not idempotent. UCP stores nothing about the AWS resources it deploys. A resource whose identifier AWS assigns, such as a VPC, subnet, or security group, is created and then fails on every deploy.
- Removed properties stay set. A property removed from the template stays set in AWS.
- Write-only properties. They are sent on every deploy, and when one also cannot change after create, every redeploy fails.
- Secrets echoed back. UCP copies secrets from the request into its response.
- Recipe deletes. One failed delete in a recipe cancels the others.
The real AWS limit is coverage: Cloud Control cannot create 28 resource types that are still in use, such as the DocumentDB cluster, the EMR cluster, and the FSx file system.
The work is split into small pull requests, tracked as sub-issues, in five phases. Bug fixes are marked Bug.
Phase 1: Bring the AWS Bicep types up to date
| # | Item | Depends on |
|---|---|---|
| 1 | Regenerate the checked-in AWS types to match the published extension (radius-project/bicep-types-aws#337) | none |
| 2 | Regenerate AWS types weekly and report breaking changes (radius-project/bicep-types-aws#338) | 1 |
Phase 2: Independent fixes
| # | Item | Depends on |
|---|---|---|
| 3 | Bug: UCP echoes secrets from the request in AWS responses (#13457) | none |
| 4a | Bug: one failed delete cancels a Bicep recipe's other output resource deletes (#13458) | none |
| 4b | Never mark read-only AWS types as Radius-managed recipe output resources (#13460) | 5 |
| 5 | Return clear errors for create-and-delete-only, read-only, legacy, and deprecated AWS types (#13459) | none |
| 6 | Link AWS output resources to the AWS console in the app graph (#13461) | none |
| 7 | Store the ARN on AWS recipe output resources (#12020) | none |
| 7b | Warn when deleting a Radius resource whose AWS output resources another Radius resource shares (#13469) | 7 |
| 7c | Bug: existing references to AWS types whose primary identifier is an ARN fail when given the friendly identifier (#13476) |
none |
| 7d | Bug: AWS redeploys send changes for values AWS reorders or normalizes (#13497) | none |
Phase 3: Make AWS deployments idempotent
| # | Item | Depends on |
|---|---|---|
| 8 | Bug: AWS resources whose identifier AWS assigns are created and then fail on every deploy (fixes #13211) | none |
| 9 | Deployment Engine: deploy AWS resources by alias, send the owner, and read alias-only existing |
ships with 8 |
| 10 | Set the owner from the recipe driver and rad deploy, and send it on recipe deletes |
ships with 8 |
| 11 | Add context.aws.resourceNameHash |
none |
| 12 | Generate and mount the HMAC key for write-only fingerprints | none |
| 13 | Bug: AWS redeploys fail or always update with write-only properties, and removed properties are never cleared | 8, 12 |
Items 8, 9, and 10 ship in the same release: 8 removes the POST /:put route, and its owner check needs the owner that 9 and 10 send.
Phase 4: Native handlers for types Cloud Control cannot create
| # | Item | Depends on |
|---|---|---|
| 16 | Add the handler registry for native AWS handlers | 5, 8 |
| 17 | Native handlers: DocumentDB cluster and instance | 16 |
| 18 | Native handlers: DAX cluster and DMS replication instance | 16 |
| 19 | Native handlers: EMR cluster and FSx file system | 16 |
| 20 | Native handlers: EC2 Client VPN and network types | 16 |
| 21 | Native handlers: Lake Formation | 16 |
| 22 | Native handlers: CodeBuild project and IAM access key | 16 |
| 23 | Native handlers: MediaLive, AppSync, CloudWatch, SageMaker, Kinesis Analytics logging, Managed Blockchain, and Service Catalog | 16 |
Phase 5: Bicep types for the new types, and end-to-end tests
| # | Item | Depends on |
|---|---|---|
| 24 | Add create-and-delete-only and read-only AWS types to Bicep | 1, 5 |
| 25 | Generate Bicep types for native AWS types from Radius schemas | 17 to 23 |
| 26 | Functional tests for native, create-and-delete-only, and read-only AWS types | 24, 25 |
Acceptance criteria
- Redeploying an unchanged template changes nothing in AWS and creates no new resources.
- Removing a property from the template clears it in AWS.
- No secret from the request appears in a UCP response.
- 24 of the 28 types Cloud Control cannot create deploy from Bicep under their CloudFormation
AWS.*names. - Create-and-delete-only types deploy from Bicep, and read-only types can be referenced with
existing. - The AWS Bicep types refresh weekly.
- AWS output resources link to the AWS console in the app graph.
Additional context
- Coverage (CloudFormation registry,
us-west-2, October 2026): Cloud Control fully manages 1,504 types, can only create and delete 167, can only read 209, and cannot create 28 that are still in use. - Not in scope:
- Four of the 28 types cannot be supported: IoT Events
AlarmModel(AWS ended IoT Events), the Alexa skill (needs Amazon developer credentials, not AWS credentials), and two Kinesis Analytics v2 types for SQL applications (AWS no longer allows creating SQL applications). - AWS features outside CloudFormation, which need their own design.
- Four of the 28 types cannot be supported: IoT Events
- Design docs:
- Making AWS deployments idempotent (Phase 3): docs: add design note for idempotent AWS deployments #13462
- Full AWS coverage (Phases 2, 4, and 5): link will be added when its pull request opens.
Activity
radius-triage commentedon Oct 24, 2026
👋 @kachawla Thanks for filing this feature request.
A project maintainer will review this feature request and get back to you soon.
We also welcome community contributions! If you would like to submit a pull request, please visit our contribution guidelines and assign this to yourself by commenting "/assign" on this issue.
For more information on our triage process please visit our triage overview