aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

(AWS::Lambda::Function) Unexpected changes to UpdatePolicy and CreationPolicy when changing [only] Metadata

Open
#1,185 1 comment 0 reactions 0 assignees View on GitHub
bug enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Lambda::Function

### Resource Name

_No response_

### Issue Description

When adding **only** Metadata attribute to a resource and then creating a change-set, the change-set contains not only Metadata attribute changes but also UpdatePolicy and CreationPolicy ones.

### Expected Behavior

The resulting changeset would only report changes to Metadata.

### Observed Behavior

Changes to UpdatePolicy & CreationPolicy are also reported in the resulting change-set.

### Test Cases

1. Create stack
2. Update to apply Metadata

```
Resources:

MyLambdaFunction:
Type: AWS::Lambda::Function
# Metadata:
# Test: Value
Properties:
Code:
ZipFile: !Sub |
import json
def handler(event, context):
print('helloworld')

Handler: index.handler
Runtime: python3.7
Role: !GetAtt LambdaExecutionRole.Arn

LambdaExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
Policies:
- PolicyName: custom_resource_policy_secretsmanager
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: arn:aws:logs:*:*:*
```

3. Create and inspect change-set

```
Capabilities:
- CAPABILITY_IAM
ChangeSetId: arn:aws:cloudformation:eu-west-1:0000000000:changeSet/changes/fdbxxxab-1b85-4a23-8707-67xxxxxf67be
ChangeSetName: changes
Changes:
- ResourceChange:
Action: Modify
Details:
- ChangeSource: DirectModification
Evaluation: Static
Target:
Attribute: Metadata
RequiresRecreation: Never
- ChangeSource: DirectModification
Evaluation: Static
Target:
Attribute: UpdatePolicy
RequiresRecreation: Never
- ChangeSource: DirectModification
Evaluation: Static
Target:
Attribute: CreationPolicy
RequiresRecreation: Never
LogicalResourceId: MyLambdaFunction
PhysicalResourceId: lab-MyLambdaFunction-eusLpdnjxbdr
Replacement: 'False'
ResourceType: AWS::Lambda::Function
Scope:
- UpdatePolicy
- Metadata
- CreationPolicy
Type: Resource
CreationTime: '2022-05-25T10:57:23.515000+00:00'
Description: null
ExecutionStatus: AVAILABLE
IncludeNestedStacks: false
NotificationARNs: []
Parameters: null
ParentChangeSetId: null
RollbackConfiguration: {}
RootChangeSetId: null
StackId: arn:aws:cloudformation:eu-west-1:000000000000:stack/lab/bdccxxxx90-dc18-11ec-8cdd-027dxxxxxxef69
StackName: lab
Status: CREATE_COMPLETE
StatusReason: null
Tags: null
```

### Other Details

If it helps, tried the same process with AWS::AutoScaling::AutoScalingGroup for comparison, but did not observe same results.

Contributor guide

Open the contributing guide

Research direction

Reproduce the change set using the AWS::Lambda::Function template and the metadata-only update described in the issue. Inspect the resulting ResourceChange scopes and compare them with the AWS::AutoScaling::AutoScalingGroup comparison; done means the change set reports Metadata without unrelated UpdatePolicy or CreationPolicy changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.