fix(aws-cdk): cdk diff always fails on diff (#17862)

In v1, the original behavior was that `cdk diff` exited 0 on a clean diff (no
changes), and exited 1 on changes. #4721 introduced a new feature flag to always
have `cdk diff` exit 0. As is standard, the "default" for the flag was `false`,
but the future behavior was `true`, meaning any new CDK project created after
that release (v1.19.0) defaulted to always exiting 0.

In v2, the feature flag was expired, meaning users could no longer set
it. Typically, the behavior (`FeatureFlags.isEnabled`) checks and errors if an
expired flag is explicitly set, and always returns true for expired flags
otherwise. However, the CDK CLI helper function did not contain this
functionality. That means for current v2 projects, the v1-ported default value
is used (false). This means `cdk diff` *always* exits 1 when there's a diff, and
there's no way for a user to disable this behavior.

This change updates the CLI behavior to default to true for expired flags, same
as any other feature flag check; this means `cdk diff` will return to exiting 0,
as v1 apps have been doing for years. The `FeatureFlags.isEnabled` method can't
be used, as it requires a Construct node.

I also took the liberty of explicitly setting the "default" to true for all
expired flags, so any other direct access of the flag (not using the FeatureFlag
library) will have the same consistent behavior.

Author: njlynch

packages/@aws-cdk/cx-api/lib/features.ts

@@ -213,17 +213,17 @@ export const FUTURE_FLAGS_EXPIRED: string[] = [
  */
 const FUTURE_FLAGS_DEFAULTS: { [key: string]: boolean } = {
   [APIGATEWAY_USAGEPLANKEY_ORDERINSENSITIVE_ID]: true,
-  [ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: false,
-  [ENABLE_DIFF_NO_FAIL_CONTEXT]: false,
+  [ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: true,
+  [ENABLE_DIFF_NO_FAIL_CONTEXT]: true,
   [STACK_RELATIVE_EXPORTS_CONTEXT]: true,
   [NEW_STYLE_STACK_SYNTHESIS_CONTEXT]: true,
-  [DOCKER_IGNORE_SUPPORT]: false,
-  [SECRETS_MANAGER_PARSE_OWNED_SECRET_NAME]: false,
-  [KMS_DEFAULT_KEY_POLICIES]: false,
-  [S3_GRANT_WRITE_WITHOUT_ACL]: false,
-  [ECS_REMOVE_DEFAULT_DESIRED_COUNT]: false,
+  [DOCKER_IGNORE_SUPPORT]: true,
+  [SECRETS_MANAGER_PARSE_OWNED_SECRET_NAME]: true,
+  [KMS_DEFAULT_KEY_POLICIES]: true,
+  [S3_GRANT_WRITE_WITHOUT_ACL]: true,
+  [ECS_REMOVE_DEFAULT_DESIRED_COUNT]: true,
   [RDS_LOWERCASE_DB_IDENTIFIER]: true,
-  [EFS_DEFAULT_ENCRYPTION_AT_REST]: false,
+  [EFS_DEFAULT_ENCRYPTION_AT_REST]: true,
   [LAMBDA_RECOGNIZE_VERSION_PROPS]: false,
   [CLOUDFRONT_DEFAULT_SECURITY_POLICY_TLS_V1_2_2021]: true,
 };

packages/aws-cdk/bin/cdk.ts

@@ -479,7 +479,10 @@ function determineV2BootstrapSource(args: { template?: string }): BootstrapSourc
 }
 
 function isFeatureEnabled(configuration: Configuration, featureFlag: string) {
-  return configuration.context.get(featureFlag) ?? cxapi.futureFlagDefault(featureFlag);
+  const context = configuration.context.get(featureFlag);
+  return cxapi.FUTURE_FLAGS_EXPIRED.includes(featureFlag)
+    ? true
+    : context ?? cxapi.futureFlagDefault(featureFlag);
 }
 
 /**