aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Incorrect Drift being detected on AWS::Config::ConfigRule
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Config::ConfigRule
### Resource Name
_No response_
### Issue Description
The issue is related to Incorrect Drift Detection being done on the resource AWS::Config::ConfigRule.
Two issues identified and are shared below in detail:
1. ConfigRule, when being created via CloudFormation, making use of "InputParameters" property, the resource is being marked as modified immediately post creation with no out of band changes being done.
2. The same resource also has another issue related to its "Source", which is also causing the resource to be marked as MODIFIED. Clicking on "Edit" Rule and saving it with **no changes** being made, is creating a new source entry as below, which is causing the drift to be detected:
```
{
"EventSource": "aws.config",
"MessageType": "OversizedConfigurationItemChangeNotification"
}
```
### Expected Behavior
For the first issue, the resource's describe call, which would be used during the drift detection, might have to be fixed/InputParameters to be included in the response. Else, CloudFormation would ideally need to find a way to retrieve the 'actual' InputParameters.
As far as the second issue is concerned, from CloudFormation pov, appears to be a warranted drift since it identifies an additional source entry. However, this too should ideally be followed up with the concerned team to fix the same.
### Observed Behavior
Resource being shown as MODIFIED, leading to misconceptions for customers.
### Test Cases
Steps to replicate:
Create a sample config rule with template as follows to replicate the 1st issue:
```
Resources:
PermissionToCallLambdaIAMPolicyBlacklisted:
Type: AWS::Lambda::Permission
Properties:
FunctionName: functionarn
Action: lambda:InvokeFunction
Principal: config.amazonaws.com
MyRule:
Type: 'AWS::Config::ConfigRule'
Properties:
ConfigRuleName: myconfigrule1
Description: Checks that an IAM resource do not contain blacklisted policy content.
Scope:
ComplianceResourceTypes:
- 'AWS::IAM::User'
- 'AWS::IAM::Group'
- 'AWS::IAM::Role'
Source:
Owner: CUSTOM_LAMBDA
SourceDetails:
- EventSource: aws.config
MessageType: ConfigurationItemChangeNotification
SourceIdentifier:
```
-> Detect drift post successful creation of stack to see stack in IN_SYNC.
-> Navigate to config rule console -> click on "Edit" -> Change nothing and click "save"
-> Detect drift once again to see the config rule resource to be marked as drift showing the added source entry.
For the second resource, the same template can be used but include "InputParameters" property.
### Other Details
_No response_
Contributor guide
Research direction
No repository files or tests are identified. Start by reproducing the drift with the supplied AWS::Config::ConfigRule template, then compare the CloudFormation resource state with the AWS Config description before and after saving without changes. Done means determining whether InputParameters or the extra SourceDetails entry is produced by CloudFormation or AWS Config and documenting the owning follow-up.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100