aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::SSM::Parameter - Drift Detection doesn't work for Tags (+ UX issue for aws:cloudformation:* in Console)
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SSM::Parameter
### Resource Name
_No response_
### Issue Description
The resource `AWS::SSM::Parameter` is [listed](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html) as support for CloudFormation Drift Detection. Drift Detection is a great feature to detect out-of-bound changes (e.g. via Console in case of an hotfix, etc.).
### Expected Behavior
Drift Detection is able to report and display changes of `Tags` for `AWS::SSM::Parameter`.
Within the Drift Detection Details, we expect Tags under "Expected" and "Actual" as part of the "View drift results".
### Observed Behavior
Drift Detection is not checking `Tags` for `AWS::SSM::Parameter` and Drift Detection does not report changed or added tags via out of the CFN stack.
### Test Cases
**step 1:**
Create a stack using following example template:
```yaml
---
AWSTemplateFormatVersion: '2010-09-09'
Description: CFN Drift detection bug - AWS::SSM::Parameter - Tags - AWS-case
Resources:
BasicParameter:
Type: AWS::SSM::Parameter
Properties:
Name: /robert/github/example/1
Type: String
Value: PleaseFixTheDriftDetection
Tier: Standard
Description: Example for SSM Parameter with Tags deployed via CFN.
Tags:
Environment: DEV
```
**step 2:**
Once the stack is successfully created, please:
Check the newly created SSM Parameter for the defined tags. Tags has been added as expected. + Run the Drift Detection. The the result - Stack is in state IN_SYNC.


**step 3:**
Change the tag and/or Add a new tag to the SSM Parameter via Console:
(In this example the value for Tag "Environment" changed from _DEV_ to _PRD_. Futhermore there is new Tag _TestTagViaConsole_ added.)


**step 4:**
Run the Drift Detection again. Drift Detection is not able to report the out-of-bound change. Stack is still reported as IN_SYNC 🤨 - This is not correct.
### Other Details
Furthermore, there is a general bad UX behavior in the **AWS Console**. The Tags `aws:cloudformation:stack-name`, `aws:cloudformation:logical-id` and `aws:cloudformation:stack-id` are (useful) CloudFormation built-in tags / default service-managed auto-tags. The Console reporting them as "_**Cannot start with aws:**_" (see above). Once you click on "Save tags" in Console, the Tags are saved, but there is no "saved successfully" in Console. It happens nothing. That's bad as well.
This happens for all SSM Parameter resources deployed as CloudFormation Stack 😟
Contributor guide
Research direction
Start with the YAML template and the four-step reproduction in the issue: create the AWS::SSM::Parameter, run drift detection, change its tags, and run drift detection again. Compare the expected and actual tag results, including the aws:cloudformation:* tags; done means tag changes are reported and the Console behavior is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, yaml
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100