aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::S3::Bucket - NotificationConfiguration - Drift detection false positive

Open
#1,072 1 comment 7 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::S3::Bucket

### Resource Name

_No response_

### Issue Description

Running drift detection on an s3 bucket resource reports drift on the `NotificationConfiguration` property and shows its drift status as `MODIFIED` with the change as `REMOVE`. However, checking the bucket in the s3 console shows that the notification configuration defined in the template is configured and enabled as expected

### Expected Behavior

S3 bucket resource should not show as `DRIFTED` when the NotificationConfiguration has not changed from what is defined in the template. Should not show as removed if it is still present on resource.

### Observed Behavior

The resource is marked as `DRIFTED` when it has a `NotificationConfiguration` defined.

### Test Cases

I tested 3 various methods of deploying this with the following template:

```
AWSTemplateFormatVersion: 2010-09-09
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: test-s3-drift-bucket
NotificationConfiguration:
EventBridgeConfiguration:
EventBridgeEnabled: true
```

**Test case 1**:
_Scenario:_ Deploy stack with bucket that has `NotificationConfiguration.EventBridgeConfiguration` defined
_Steps:_

1. Deploy stack with template containing s3 bucket that has `EventBridgeConfiguration` enabled
2. Check s3 bucket in console to verify that EventBridge is enabled
3. Check resource for drift

_Result:_ Shows as drifted with `NotificationConfiguration` being removed

**Test case 2**:
_Scenario:_ Deploy stack with bucket that does not have `NotificationConfiguration.EventBridgeConfiguration` defined, and then update stack to add it.
_Steps:_

1. Deploy stack with template containing s3 bucket that has `NotificationConfiguration` property commented out
2. Update stack to un-comment the property
3. Check s3 bucket in console to verify that EventBridge is enabled
4. Check resource for drift

_Result:_ Shows as drifted with `NotificationConfiguration` being removed

**Test case 3**:
_Scenario:_ Deploy stack with bucket that has `NotificationConfiguration.EventBridgeConfiguration` defined, update to remove, update again to add back
_Steps:_

1. Deploy stack with template containing s3 bucket that has `EventBridgeConfiguration` enabled
2. Update stack to comment out the property
3. Update stack to un-comment the property
3. Check s3 bucket in console to verify that EventBridge is enabled
4. Check resource for drift

_Result:_ Shows as drifted with `NotificationConfiguration` being removed

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing drift detection for an AWS::S3::Bucket using the NotificationConfiguration.EventBridgeConfiguration template shown in the issue, then compare the reported drift with the S3 console state. Done means an unchanged, enabled notification configuration is not reported as removed or as resource drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.