An engineer maintains infrastructure with the AWS CDK and has already deployed the application stack. Before applying the next change, the team wants a clear, resource-by-resource report of what the pending code change would add, modify or destroy in the currently deployed stack, so a reviewer can spot any unexpected replacement before anything is provisioned. Which CDK command produces this comparison against the deployed stack?
- ARun cdk synth, which emits the CloudFormation template the app would deploy so the reviewer can read the full template that the code produces.
- BRun cdk deploy with the no-execute option so the deployment is prepared and a reviewer can read the resulting events as the change is applied.
- CRun cdk bootstrap, which prepares the account and Region with the resources the toolkit needs before any stack in that environment can be deployed.
- DRun cdk diff, which compares the synthesised template from the current code against the deployed stack and reports the resources and properties that would change. Correct
Why A is wrong: cdk synth only outputs the generated template; it does not compare against the deployed stack, so the reviewer sees the whole template rather than the specific pending changes.
Why B is wrong: cdk deploy provisions resources and has no plain no-execute flag that only reports a comparison, so it would alter the account rather than preview the differences first.
Why C is wrong: cdk bootstrap provisions the toolkit staging resources for an environment and produces no comparison of pending application changes, so it does not answer what would change.
Why D is correct: cdk diff synthesises the template and compares it to the live deployed stack, listing additions, changes and replacements before any deployment, which is exactly the pre-change report wanted.