Observed (live, us-east-1, 2026-07-31)
On an account with a pre-existing default CDKToolkit stack, mise //cdk:bootstrap (and the underlying npx cdk bootstrap --template bootstrap/bootstrap-template.yaml) exits 0 without applying the ABCA template: BootstrapVariant stays AWS CDK: Default Resources, the CloudFormation execution role keeps AdministratorAccess, and the five ABCA scoped policies are never attached. Because the command reports success, the operator has no signal, and the condition recurs on every retry.
Workaround that succeeded during the ADR-021 P1 verification run: pass --force.
Proposal
- Add
--force to the bootstrap task (or detect the variant mismatch and fail loudly with the --force remedy)
- Document the already-bootstrapped-account case in DEPLOYMENT_ROLES.md alongside the existing
ComputeTypes parameter guidance
Found during the ADR-021 P1 live verification (evidence in the #645 verification findings). Refs #645.
Observed (live, us-east-1, 2026-07-31)
On an account with a pre-existing default
CDKToolkitstack,mise //cdk:bootstrap(and the underlyingnpx cdk bootstrap --template bootstrap/bootstrap-template.yaml) exits 0 without applying the ABCA template:BootstrapVariantstaysAWS CDK: Default Resources, the CloudFormation execution role keepsAdministratorAccess, and the five ABCA scoped policies are never attached. Because the command reports success, the operator has no signal, and the condition recurs on every retry.Workaround that succeeded during the ADR-021 P1 verification run: pass
--force.Proposal
--forceto the bootstrap task (or detect the variant mismatch and fail loudly with the--forceremedy)ComputeTypesparameter guidanceFound during the ADR-021 P1 live verification (evidence in the #645 verification findings). Refs #645.