aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::S3::BucketPolicy - Request for Drift Detection

Open
#2,169 0 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::S3::BucketPolicy

### Resource name

_No response_

### Description

Currently, `AWS::S3::BucketPolicy` is [not supported for drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html). This poses a problem when the actual bucket policy is not attached to the S3 bucket resource (for example, due to manual deletion), as it may incorrectly indicate that there is nothing wrong with the stack.

Additionally, `AWS::S3::Bucket` does not include a bucket policy resource property, which means CloudFormation cannot verify whether the policy is still attached.

We are requesting that CloudFormation implement a mechanism to check if `AWS::S3::BucketPolicy` is still attached to the corresponding S3 bucket. This could be achieved through drift detection for either the bucket policy resource or the S3 bucket resource itself.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue does not identify repository files, tests, or an implementation entry point. Start by reviewing the requested AWS::S3::BucketPolicy drift-detection behavior and the linked CloudFormation resource documentation; done means CloudFormation can detect whether the policy remains attached to the bucket.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.