aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::RDS::GlobalCluster - False-positive drift on Tags

Open
#2,275 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::RDS::GlobalCluster

### Resource Name

_No response_

### Issue Description

Drift detection does not reflect the true state of the Tags values applied on the resource.

### Expected Behavior

The Tags returned in the drift report should accurately reflect the tags applied on the physical resource.

### Observed Behavior

Tag values provided in the drift detection report output are empty, thus causing the resource to be in the "MODIFIED" state, with "REMOVE" being advised.
```
{
"StackId": "arn:aws:cloudformation:us-east-1:0123456789:stack/rds-global-cluster-drift-bug/abcd-1234",
"LogicalResourceId": "GlobalCluster",
"PhysicalResourceId": "rds-global-test",
"ResourceType": "AWS::RDS::GlobalCluster",
"ExpectedProperties": "{\"GlobalClusterIdentifier\":\"rds-global-test\",\"SourceDBClusterIdentifier\":\"rds-global-test-rdscluster-abcd\",\"Tags\":[{\"Key\":\"test2\",\"Value\":\"test2\"},{\"Key\":\"test1\",\"Value\":\"test1\"}]}",
"ActualProperties": "{\"GlobalClusterIdentifier\":\"rds-global-test\",\"SourceDBClusterIdentifier\":\"arn:aws:rds:us-east-1:0123456789:cluster:rds-global-test-rdscluster-abcd\"}",
"PropertyDifferences": [
{
"PropertyPath": "/SourceDBClusterIdentifier",
"ExpectedValue": "rds-global-test-rdscluster-abcd",
"ActualValue": "arn:aws:rds:us-east-1:0123456789:cluster:rds-global-test-rdscluster-abcd",
"DifferenceType": "NOT_EQUAL"
},
{
"PropertyPath": "/Tags",
"ExpectedValue": "[{\"Key\":\"test2\",\"Value\":\"test2\"},{\"Key\":\"test1\",\"Value\":\"test1\"}]",
"ActualValue": "null",
"DifferenceType": "REMOVE"
}
],
"StackResourceDriftStatus": "MODIFIED",
"Timestamp": "2025-03-11T10:50:12.765000+00:00"
}
```

### Test Cases

Execute the below AWS CLI command / deploy the CloudFormation template and immediately run drift detection on the stack:

```
aws cloudformation create-stack --stack-name rds-global-cluster-drift-bug --tags Key=test1,Value=test1 Key=test2,Value=test2 --template-body \
'{
"Resources": {
"RDSCluster": {
"Type": "AWS::RDS::DBCluster",
"Properties": {
"DBClusterParameterGroupName": "default.aurora-mysql8.0",
"Engine": "aurora-mysql",
"EngineVersion": "8.0.mysql_aurora.3.08.1",
"MasterUsername": "admin",
"MasterUserPassword": 12345678
}
},
"GlobalCluster": {
"Type": "AWS::RDS::GlobalCluster",
"Properties": {
"GlobalClusterIdentifier": "rds-global-test",
"SourceDBClusterIdentifier": {
"Ref": "RDSCluster"
}
}
}
}
}'
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by running the provided AWS CLI create-stack command and template, then immediately run CloudFormation drift detection for AWS::RDS::GlobalCluster. Compare the reported ActualProperties and PropertyDifferences for Tags with the tags applied to the stack and physical resource; done means the report reflects the actual tag values without a false REMOVE difference.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.