aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::RDS::GlobalCluster] - False positive drift on 'SourceDBClusterIdentifer' property

Open
#2,156 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::RDS::GlobalCluster

### Resource Name

_No response_

### Issue Description

The 'AWS::RDS::GlobalCluster' resource is showing as false positive drift for the 'SourceDBClusterIdentifer' property where the ARN is being passed instead of the cluster identifier/physical resource ID.

According to this AWS [documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-globalcluster.html#cfn-rds-globalcluster-sourcedbclusteridentifier), the "SourceDBClusterIdentifier" value should be the Amazon Resource Name (ARN) to use as the primary cluster of the global database. We see that the template is using a Reference to the "AWS::RDS::DBCluster" resource and according to this [documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#aws-resource-rds-dbcluster-return-values) Ref should be returning the name (DBClusterIdentifier) of the DB cluster, however, is it seen that even if the identifier/name is being passed (either via ref or hardcoded), it is being converted automatically to an ARN causing a false positive drift in CFN.

### Expected Behavior

When using Ref or hardcoding the value for the SourceDBClusterIdentifer property, it should not show as Drifted as no manual changes were made outside of CFN

### Observed Behavior

When the identifier/name is being passed (either via ref or hardcoded), it is being passed as an ARN causing a false positive drift in CFN:
[
{
"Type": "AWS::RDS::GlobalCluster",
"Resource": "GlobalCluster",
"Status": "MODIFIED",
"Diff": [
{
"PropertyPath": "/SourceDBClusterIdentifier",
"ExpectedValue": "name-of-cluster",
"ActualValue": "arn:aws:rds:us-east-1:123456789123:cluster:name-of-cluster",
"DifferenceType": "NOT_EQUAL"
}
]
}
]

### Test Cases

Create a Global Database cluster for Aurora PostgreSQL, you may use the template from this example in the docs:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-globalcluster.html#aws-resource-rds-globalcluster--examples--Creating_a_Global_Database_cluster_for_Aurora_PostgreSQL

Once the stack has created successfully, run drift detection on the stack and the stack will show as drifted with the AWS::RDS::GlobalCluster showing as modified for the SourceDBClusterIdentifier property

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the linked AWS::RDS::GlobalCluster and AWS::RDS::DBCluster documentation and reproduce the Aurora PostgreSQL example, then run stack drift detection. Done means SourceDBClusterIdentifier is not reported as modified when the configured identifier or Ref resolves to the cluster ARN; the report names no repository files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.