aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::S3::BucketPolicy - Request for Drift Detection
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::S3::BucketPolicy
### Resource name
_No response_
### Description
Currently, `AWS::S3::BucketPolicy` is [not supported for drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html). This poses a problem when the actual bucket policy is not attached to the S3 bucket resource (for example, due to manual deletion), as it may incorrectly indicate that there is nothing wrong with the stack.
Additionally, `AWS::S3::Bucket` does not include a bucket policy resource property, which means CloudFormation cannot verify whether the policy is still attached.
We are requesting that CloudFormation implement a mechanism to check if `AWS::S3::BucketPolicy` is still attached to the corresponding S3 bucket. This could be achieved through drift detection for either the bucket policy resource or the S3 bucket resource itself.
### Other Details
_No response_
Contributor guide
Research direction
The issue does not identify repository files, tests, or an implementation entry point. Start by reviewing the requested AWS::S3::BucketPolicy drift-detection behavior and the linked CloudFormation resource documentation; done means CloudFormation can detect whether the policy remains attached to the bucket.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100