aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::S3::Bucket - NotificationConfiguration - Drift detection false positive
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::S3::Bucket
### Resource Name
_No response_
### Issue Description
Running drift detection on an s3 bucket resource reports drift on the `NotificationConfiguration` property and shows its drift status as `MODIFIED` with the change as `REMOVE`. However, checking the bucket in the s3 console shows that the notification configuration defined in the template is configured and enabled as expected
### Expected Behavior
S3 bucket resource should not show as `DRIFTED` when the NotificationConfiguration has not changed from what is defined in the template. Should not show as removed if it is still present on resource.
### Observed Behavior
The resource is marked as `DRIFTED` when it has a `NotificationConfiguration` defined.
### Test Cases
I tested 3 various methods of deploying this with the following template:
```
AWSTemplateFormatVersion: 2010-09-09
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: test-s3-drift-bucket
NotificationConfiguration:
EventBridgeConfiguration:
EventBridgeEnabled: true
```
**Test case 1**:
_Scenario:_ Deploy stack with bucket that has `NotificationConfiguration.EventBridgeConfiguration` defined
_Steps:_
1. Deploy stack with template containing s3 bucket that has `EventBridgeConfiguration` enabled
2. Check s3 bucket in console to verify that EventBridge is enabled
3. Check resource for drift
_Result:_ Shows as drifted with `NotificationConfiguration` being removed
**Test case 2**:
_Scenario:_ Deploy stack with bucket that does not have `NotificationConfiguration.EventBridgeConfiguration` defined, and then update stack to add it.
_Steps:_
1. Deploy stack with template containing s3 bucket that has `NotificationConfiguration` property commented out
2. Update stack to un-comment the property
3. Check s3 bucket in console to verify that EventBridge is enabled
4. Check resource for drift
_Result:_ Shows as drifted with `NotificationConfiguration` being removed
**Test case 3**:
_Scenario:_ Deploy stack with bucket that has `NotificationConfiguration.EventBridgeConfiguration` defined, update to remove, update again to add back
_Steps:_
1. Deploy stack with template containing s3 bucket that has `EventBridgeConfiguration` enabled
2. Update stack to comment out the property
3. Update stack to un-comment the property
3. Check s3 bucket in console to verify that EventBridge is enabled
4. Check resource for drift
_Result:_ Shows as drifted with `NotificationConfiguration` being removed
### Other Details
_No response_
Contributor guide
Research direction
Start by reproducing drift detection for an AWS::S3::Bucket using the NotificationConfiguration.EventBridgeConfiguration template shown in the issue, then compare the reported drift with the S3 console state. Done means an unchanged, enabled notification configuration is not reported as removed or as resource drift.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100