cdk diff Command Reference

Compare your CDK app against the currently deployed stacks.

cdk diff synthesizes your app and compares it against the deployed CloudFormation stacks, reporting added, changed, and removed resources plus security-relevant changes.

What it does

cdk diff shows the delta between local code and the live stack: resource changes, IAM and security group changes, and parameter differences. It is the review aid you post on pull requests before approving a deploy.

Common flags and usage

STACK_NAME: diff a single stack
--fail: exit with a non-zero code if any difference is found
--context KEY=VALUE: pass synthesis context
--security-only: show only security-impacting changes
--no-color: plain output for posting into PR comments

Example

shell

- name: CDK Diff
  env:
    AWS_REGION: us-east-1
  run: npx cdk diff --no-color > cdk-diff.txt || true

- name: Comment diff on PR
  run: gh pr comment "${{ github.event.number }}" --body-file cdk-diff.txt

In CI

Run cdk diff on pull requests with read-only AWS credentials and post the result as a PR comment so reviewers see the blast radius before merge. Use --fail in a gate job to block when unexpected changes appear. The same Latchkey runner can host the diff and deploy jobs for consistent tooling.

Key takeaways

cdk diff compares local CDK code against the deployed CloudFormation stack.
Post the diff on pull requests so reviewers see changes before merge.
--fail turns diff into a gate that blocks on unexpected changes.