When running cdk diff commandline, the exit code is 1 in case there is a diff. While this might be useful if you are aware of it, it is semantically wrong, because the diff command executed successfully. When you stumble upon it you immediately go and check what you did wrong. I also did not find this behaviour documented anywhere.