aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

(AWS::EC2::LaunchTemplate) "Smart" drift detection

Open
#2,001 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::LaunchTemplate

### Resource name

_No response_

### Description

Cloudformation drift detection is reporting AWS::EC2::LaunchTemplate as IN_SYNC, despite having been modified directly by out-of-band changes.

For the full discussion and my replication, kindly refer to the associated issue [ (AWS::EC2::LaunchTemplate) Implement Drift Detection #1682 ](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1682)

*Snippet of Cloudformation template*
``` json
{
"LaunchTemplate04EC5460": {
"Type": "AWS::EC2::LaunchTemplate",
"Properties": {
"LaunchTemplateData": {
"ImageId": {
"Ref": "SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter"
},
"InstanceType": "t2.micro",
"TagSpecifications": [
{
"ResourceType": "instance",
"Tags": [
{
"Key": "Name",
"Value": "Ec2Stack/LaunchTemplateNestedStack/LaunchTemplate"
}
]
},
{
"ResourceType": "volume",
"Tags": [
{
"Key": "Name",
"Value": "Ec2Stack/LaunchTemplateNestedStack/LaunchTemplate"
}
]
}
],
"UserData": {
"Fn::Base64": "#!/bin/bash"
}
},
"TagSpecifications": [
{
"ResourceType": "launch-template",
"Tags": [
{
"Key": "Name",
"Value": "Ec2Stack/LaunchTemplateNestedStack/LaunchTemplate"
}
]
}
]
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
}
}
```

Above is a snippet of the Cloudformation template deployed during testing. a describe call returns the following properties...
``` json
{
"LaunchTemplates": [
{
"LaunchTemplateId": "lt-01ef0cd996b75a977",
"LaunchTemplateName": "LaunchTemplate04EC5460_mUsgVJDQsAoD",
"CreateTime": "2024-03-21T11:36:30+00:00",
"CreatedBy": "arn:aws:sts::000000000000:assumed-role/cdk-hnb659fds-cfn-exec-role-000000000000-eu-central-1/AWSCloudFormation",
"DefaultVersionNumber": 1,
"LatestVersionNumber": 2,
"Tags": [
{
"Key": "Name",
"Value": "Ec2Stack/LaunchTemplateNestedStack/LaunchTemplate"
}
]
}
]
}

```

since launch templates are immutable, the only property returned in the describe call that indicates any changes have been made is ```LatestVersionNumber```.

according to the current [discussion](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1682#issuecomment-2012509090) on the GitHub ticket, since ```LatestVersionNumber``` is a ```readOnly``` property in the resource schema, Cloudformation does not include this property in drift detection.

*excerpt of schema*
``` yaml
readOnlyProperties:
- /properties/DefaultVersionNumber
- /properties/LaunchTemplateId
- /properties/LatestVersionNumber
writeOnlyProperties:
- /properties/LaunchTemplateData
- /properties/VersionDescription
- /properties/TagSpecifications
createOnlyProperties:
- /properties/LaunchTemplateName
```
although technically correct, i feel the [comment](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1682#issuecomment-2014419430) is also very valid. a customer should not need to need to go to such lengths to learn why modified resources are not reporting as drifted, despite the official docs explicitly stating it is supported.

i feel this is a good opportunity to improve the general experience for all. when detecting drift on a Launch Template, from the customer's perspective Cloudformation should be "smart" enough to see the ```LatestVersionNumber``` has changed, and to then drill deeper into the various properties to compare with that of the previous version.

Different perspectives are appreciated and welcomed. and i'll be happy to provide any further clarity and context if needed.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.