aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

(AWS::SSM::Document) Drift detection not supported contrary to documentation

Open
#1,957 2 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SSM::Document

### Resource Name

_No response_

### Issue Description

*AWS::SSM::Document* resource types are not included in drift detection despite being listed as supported in [official documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html).

### Expected Behavior

*AWS::SSM::Document* to be included in drift detection.

### Observed Behavior

It is not.

### Test Cases

# Reproduction

1. Initial deployment

*template.yaml*
```
Resources:
Document:
Type: AWS::SSM::Document
Properties:
Name: "Test"
DocumentType: "Command"
Content:
schemaVersion: "2.2"
description: "Test"
mainSteps:
- action: aws:runShellScript
name: runCommands
precondition:
StringEquals:
- platformType
- Linux
inputs:
runCommand:
- 'Echo "Testing drift"'
```

```
aws cloudformation deploy --template-file template.yaml --stack-name DriftTest
```

2. Detect drift

```
aws cloudformation detect-stack-drift --stack-name DriftTest
```

```
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id 24acf780-db86-11ee-9f3b-020c1711b96b
```

```
{
"StackId": "arn:aws:cloudformation:eu-central-1:000000000000:stack/DriftTest/2a4875c0-db81-11ee-a4cd-0a15f25d6671",
"StackDriftDetectionId": "24acf780-db86-11ee-9f3b-020c1711b96b",
"StackDriftStatus": "IN_SYNC",
"DetectionStatus": "DETECTION_COMPLETE",
"DriftedStackResourceCount": 0,
"Timestamp": "2024-03-06T06:52:48.248000+00:00"
}
```

3. Make out-of-band change

content.yaml
```
schemaVersion: "2.2"
description: "TestTwo"
mainSteps:
- action: aws:runShellScript
name: runCommands
precondition:
StringEquals:
- platformType
- Linux
inputs:
runCommand:
- 'Echo "This should cause drift"'
```

```
aws ssm update-document --name "Test" --content "file://content.yaml" --document-version 2
```

4. Detect drift again

```
aws cloudformation detect-stack-drift --stack-name DriftTest
```

```
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id 0418dbf0-db87-11ee-8a48-02216b952413
```

```
{
"StackId": "arn:aws:cloudformation:eu-central-1:000000000000:stack/DriftTest/2a4875c0-db81-11ee-a4cd-0a15f25d6671",
"StackDriftDetectionId": "0418dbf0-db87-11ee-8a48-02216b952413",
"StackDriftStatus": "IN_SYNC",
"DetectionStatus": "DETECTION_COMPLETE",
"DriftedStackResourceCount": 0,
"Timestamp": "2024-03-06T06:59:03.087000+00:00"
}
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with template.yaml and content.yaml, then run the documented aws cloudformation deploy, detect-stack-drift, and aws ssm update-document commands to reproduce the behavior. Done means an out-of-band AWS::SSM::Document content change is reported as drift rather than IN_SYNC; the issue names no repository files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.