aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::SSM::Parameter - Drift Detection doesn't work for Tags (+ UX issue for aws:cloudformation:* in Console)

Open
#1,890 1 comment 4 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SSM::Parameter

### Resource Name

_No response_

### Issue Description

The resource `AWS::SSM::Parameter` is [listed](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html) as support for CloudFormation Drift Detection. Drift Detection is a great feature to detect out-of-bound changes (e.g. via Console in case of an hotfix, etc.).

### Expected Behavior

Drift Detection is able to report and display changes of `Tags` for `AWS::SSM::Parameter`.
Within the Drift Detection Details, we expect Tags under "Expected" and "Actual" as part of the "View drift results".

### Observed Behavior

Drift Detection is not checking `Tags` for `AWS::SSM::Parameter` and Drift Detection does not report changed or added tags via out of the CFN stack.

### Test Cases

**step 1:**

Create a stack using following example template:
```yaml
---
AWSTemplateFormatVersion: '2010-09-09'
Description: CFN Drift detection bug - AWS::SSM::Parameter - Tags - AWS-case

Resources:
BasicParameter:
Type: AWS::SSM::Parameter
Properties:
Name: /robert/github/example/1
Type: String
Value: PleaseFixTheDriftDetection
Tier: Standard
Description: Example for SSM Parameter with Tags deployed via CFN.
Tags:
Environment: DEV
```

**step 2:**

Once the stack is successfully created, please:
Check the newly created SSM Parameter for the defined tags. Tags has been added as expected. + Run the Drift Detection. The the result - Stack is in state IN_SYNC.
![01_TagsAfterDeploy-OK](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/16392819/3cfb0fac-ff6e-4e84-afb1-6492783f4ff6)
![01_DriftCheck](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/16392819/b6499327-4294-4afd-9129-0a4f725bf97f)

**step 3:**

Change the tag and/or Add a new tag to the SSM Parameter via Console:
(In this example the value for Tag "Environment" changed from _DEV_ to _PRD_. Futhermore there is new Tag _TestTagViaConsole_ added.)
![02_TagsChangedViaConsole](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/16392819/e30b38d6-2c9b-4515-bc01-f0958fe886eb)
![02_DriftCheckAgain](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/16392819/382e1f85-d4a9-43e3-8257-2871ddfde5c4)

**step 4:**

Run the Drift Detection again. Drift Detection is not able to report the out-of-bound change. Stack is still reported as IN_SYNC 🤨 - This is not correct.

### Other Details

Furthermore, there is a general bad UX behavior in the **AWS Console**. The Tags `aws:cloudformation:stack-name`, `aws:cloudformation:logical-id` and `aws:cloudformation:stack-id` are (useful) CloudFormation built-in tags / default service-managed auto-tags. The Console reporting them as "_**Cannot start with aws:**_" (see above). Once you click on "Save tags" in Console, the Tags are saved, but there is no "saved successfully" in Console. It happens nothing. That's bad as well.

This happens for all SSM Parameter resources deployed as CloudFormation Stack 😟

Contributor guide

Open the contributing guide

Research direction

Start with the YAML template and the four-step reproduction in the issue: create the AWS::SSM::Parameter, run drift detection, change its tags, and run drift detection again. Compare the expected and actual tag results, including the aws:cloudformation:* tags; done means tag changes are reported and the Console behavior is addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, yaml
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.