aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Drift Detection for AWS::IAM::ManagedPolicy resource reported as IN_SYNC when there is drift
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::ManagedPolicy
### Resource Name
_No response_
### Issue Description
Drift detection on a stack with AWS::IAM::ManagedPolicy resource reports back as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.
Expected:
`{
"Path": "/",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"rds:CreateDBInstance",
"rds:CreateDBClusterParameterGroup"
],
"Resource": "arn:aws:rds:region:account-no:db:test*",
"Effect": "Allow",
"Sid": "Statement1"
}
]
},
"Description": "Policy for creating a test database"
}`
Actual:
`
{
"Path": "/",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"rds:CreateDBInstance"
],
"Resource": "arn:aws:rds:region:account-no:db:test*",
"Effect": "Allow",
"Sid": "Statement1"
}
]
},
"Description": "Policy for creating a test database"
}
`
### Expected Behavior
If there is a difference in the policy document json between actual resource and template specification, the resource should report as modified when performing drift detection.
### Observed Behavior
Resource reports as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.
### Test Cases
1. Create a Cloudformation stack to provision a ManagedPolicy resource.
Resources:
```
Resources:
CreateTestDBPolicy:
Type: 'AWS::IAM::ManagedPolicy'
Properties:
Description: Policy for creating a test database
Path: /
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: 'Statement1'
Effect: Allow
Action:
- 'rds:CreateDBInstance'
- 'rds:CreateDBClusterParameterGroup'
Resource: !Join
- ''
- - 'arn:aws:rds:'
- !Ref 'AWS::Region'
- ':'
- !Ref 'AWS::AccountId'
- ':db:test*'
```
2. Once the stack is created, Manually modify the managed policy physical resource - you can change any part(s) of the policy. eg: remove "'rds:CreateDBClusterParameterGroup'" from policy document.
3. Trigger drift detection on stack, the resource will report as "IN_SYNC" check the drift details and we can observe difference in Actual and Expected properties.
### Other Details
_No response_
Contributor guide
Research direction
Reproduce the issue by creating the described AWS::IAM::ManagedPolicy stack, removing an action from the managed policy, and running stack drift detection. Compare the expected and actual PolicyDocument values in the drift details; done means the resource is reported as modified rather than IN_SYNC when they differ.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100