aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Drift detection on AWS::EC2::Instance reports false-positive drift for IamInstanceProfile property
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::Instance
### Resource Name
_No response_
### Issue Description
AWS::EC2::Instance reports a false positive Drift for IamInstanceProfile property immediately after stack creation with no out of band change.
### Expected Behavior
The resource should be in Sync since IAM instance profile role is not altered out of band.
### Observed Behavior
- 'IamInstanceProfile' property expects IAM instance profile role 'NAME'. Whereas during drift detection the value returned to cloudformation is IAM instance profile role 'Arn'.
- This causes an incorrect drift since the values are actually same, just the template as Name of role and ec2 returns an Arn during drift detection.
### Test Cases
Steps to reproduce:
1. Create IAM instance profile role using AWS::IAM::InstanceProfile resource
2. Reference it under AWS::EC2::Instance for 'IamInstanceProfile' property - (Ref returns name of instance profile)
3. Once stack is in CreateComplete, detect drift - AWS::EC2::Instance will be marked as Drifted.
```
MyInstance:
Type: 'AWS::EC2::Instance'
Properties:
InstanceType: !Ref InstanceType
IamInstanceProfile: !Ref InstanceProfile
ImageId: ami-xxx
InstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Path: "/"
InstanceProfileName: TestInstaneProfile
Roles:
- RoleName
```
### Other Details
_No response_
Contributor guide
Research direction
Start with the supplied AWS::EC2::Instance and AWS::IAM::InstanceProfile reproduction, then run drift detection after stack creation. Compare the template's instance-profile name from Ref with the ARN returned during detection; done means the unchanged resource is reported as In Sync.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100