Trying to get ephemeral environments to tear down cleanly and using SST Script to do some work that is outside the purview of CloudFormation. Works for stack creation, but at teardown the dependency isn't being recognized. Notice that the

Script

receives

bootstrapThingPolicy

as a parameter, but upon removing the stack CloudFormation immediately tries to delete

BootstrapThingPolicy

, before running the

onDelete

script.

const bootstrapThingPolicy = new CfnPolicy(this, "BootstrapThingPolicy", {
      policyName: scope.logicalPrefixedName("bootstrap-thing-policy"),
      policyDocument: bootstrapThingPolicyDocument,
    });

    const namespace = scope.logicalPrefixedName("").slice(0, -1);
    new Script(this, "bootstrap", {
      defaultFunctionProps: {
        timeout: 60,
        memorySize: 128,
        permissions: toPermissions(
          new statement.Iot()
            .allow()
            .toAttachPolicy()
            .toAttachThingPrincipal()
            .toCreateKeysAndCertificate()
            .toCreateThing()
            .toDeleteCertificate()
            .toDeleteThing()
            .toDescribeEndpoint()
            .toDescribeThing()
            .toDetachPolicy()
            .toDetachThingPrincipal()
            .toListPrincipalPolicies()
            .toListThingPrincipals()
            .toUpdateCertificate()
            .onAllResources(),
          new statement.Ssm().allow().toDeleteParameter().toPutParameter().onAllResources()
        ),
        logRetention: RetentionDays.ONE_MONTH,
      },
      params: {
        namespace,
        boostrapThingPolicyName: bootstrapThingPolicy.policyName,
      },
      onCreate: "src/stacks/iot-provisioning/bootstrap-cert-script.onCreate",
      onDelete: "src/stacks/iot-provisioning/bootstrap-cert-script.onDelete",
    });
  }