aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::RDS::GlobalCluster] - False positive drift on 'SourceDBClusterIdentifer' property
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::RDS::GlobalCluster
### Resource Name
_No response_
### Issue Description
The 'AWS::RDS::GlobalCluster' resource is showing as false positive drift for the 'SourceDBClusterIdentifer' property where the ARN is being passed instead of the cluster identifier/physical resource ID.
According to this AWS [documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-globalcluster.html#cfn-rds-globalcluster-sourcedbclusteridentifier), the "SourceDBClusterIdentifier" value should be the Amazon Resource Name (ARN) to use as the primary cluster of the global database. We see that the template is using a Reference to the "AWS::RDS::DBCluster" resource and according to this [documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#aws-resource-rds-dbcluster-return-values) Ref should be returning the name (DBClusterIdentifier) of the DB cluster, however, is it seen that even if the identifier/name is being passed (either via ref or hardcoded), it is being converted automatically to an ARN causing a false positive drift in CFN.
### Expected Behavior
When using Ref or hardcoding the value for the SourceDBClusterIdentifer property, it should not show as Drifted as no manual changes were made outside of CFN
### Observed Behavior
When the identifier/name is being passed (either via ref or hardcoded), it is being passed as an ARN causing a false positive drift in CFN:
[
{
"Type": "AWS::RDS::GlobalCluster",
"Resource": "GlobalCluster",
"Status": "MODIFIED",
"Diff": [
{
"PropertyPath": "/SourceDBClusterIdentifier",
"ExpectedValue": "name-of-cluster",
"ActualValue": "arn:aws:rds:us-east-1:123456789123:cluster:name-of-cluster",
"DifferenceType": "NOT_EQUAL"
}
]
}
]
### Test Cases
Create a Global Database cluster for Aurora PostgreSQL, you may use the template from this example in the docs:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-globalcluster.html#aws-resource-rds-globalcluster--examples--Creating_a_Global_Database_cluster_for_Aurora_PostgreSQL
Once the stack has created successfully, run drift detection on the stack and the stack will show as drifted with the AWS::RDS::GlobalCluster showing as modified for the SourceDBClusterIdentifier property
### Other Details
_No response_
Contributor guide
Research direction
Start with the linked AWS::RDS::GlobalCluster and AWS::RDS::DBCluster documentation and reproduce the Aurora PostgreSQL example, then run stack drift detection. Done means SourceDBClusterIdentifier is not reported as modified when the configured identifier or Ref resolves to the cluster ARN; the report names no repository files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100