aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Drift Detection for AWS::IAM::ManagedPolicy resource reported as IN_SYNC when there is drift

Open
#1,858 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::ManagedPolicy

### Resource Name

_No response_

### Issue Description

Drift detection on a stack with AWS::IAM::ManagedPolicy resource reports back as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.

Expected:
`{
"Path": "/",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"rds:CreateDBInstance",
"rds:CreateDBClusterParameterGroup"
],
"Resource": "arn:aws:rds:region:account-no:db:test*",
"Effect": "Allow",
"Sid": "Statement1"
}
]
},
"Description": "Policy for creating a test database"
}`

Actual:
`
{
"Path": "/",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"rds:CreateDBInstance"
],
"Resource": "arn:aws:rds:region:account-no:db:test*",
"Effect": "Allow",
"Sid": "Statement1"
}
]
},
"Description": "Policy for creating a test database"
}
`

### Expected Behavior

If there is a difference in the policy document json between actual resource and template specification, the resource should report as modified when performing drift detection.

### Observed Behavior

Resource reports as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.

### Test Cases

1. Create a Cloudformation stack to provision a ManagedPolicy resource.
Resources:
```
Resources:
CreateTestDBPolicy:
Type: 'AWS::IAM::ManagedPolicy'
Properties:
Description: Policy for creating a test database
Path: /
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: 'Statement1'
Effect: Allow
Action:
- 'rds:CreateDBInstance'
- 'rds:CreateDBClusterParameterGroup'
Resource: !Join
- ''
- - 'arn:aws:rds:'
- !Ref 'AWS::Region'
- ':'
- !Ref 'AWS::AccountId'
- ':db:test*'
```

2. Once the stack is created, Manually modify the managed policy physical resource - you can change any part(s) of the policy. eg: remove "'rds:CreateDBClusterParameterGroup'" from policy document.
3. Trigger drift detection on stack, the resource will report as "IN_SYNC" check the drift details and we can observe difference in Actual and Expected properties.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue by creating the described AWS::IAM::ManagedPolicy stack, removing an action from the managed policy, and running stack drift detection. Compare the expected and actual PolicyDocument values in the drift details; done means the resource is reported as modified rather than IN_SYNC when they differ.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.