aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Drift detection on AWS::EC2::Instance reports false-positive drift for IamInstanceProfile property

Open
#1,383 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::Instance

### Resource Name

_No response_

### Issue Description

AWS::EC2::Instance reports a false positive Drift for IamInstanceProfile property immediately after stack creation with no out of band change.

### Expected Behavior

The resource should be in Sync since IAM instance profile role is not altered out of band.

### Observed Behavior

- 'IamInstanceProfile' property expects IAM instance profile role 'NAME'. Whereas during drift detection the value returned to cloudformation is IAM instance profile role 'Arn'.
- This causes an incorrect drift since the values are actually same, just the template as Name of role and ec2 returns an Arn during drift detection.

### Test Cases

Steps to reproduce:

1. Create IAM instance profile role using AWS::IAM::InstanceProfile resource
2. Reference it under AWS::EC2::Instance for 'IamInstanceProfile' property - (Ref returns name of instance profile)
3. Once stack is in CreateComplete, detect drift - AWS::EC2::Instance will be marked as Drifted.
```
MyInstance:
Type: 'AWS::EC2::Instance'
Properties:
InstanceType: !Ref InstanceType
IamInstanceProfile: !Ref InstanceProfile
ImageId: ami-xxx

InstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Path: "/"
InstanceProfileName: TestInstaneProfile
Roles:
- RoleName
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the supplied AWS::EC2::Instance and AWS::IAM::InstanceProfile reproduction, then run drift detection after stack creation. Compare the template's instance-profile name from Ref with the ARN returned during detection; done means the unchanged resource is reported as In Sync.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.