aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::SNS::Subscription] - [BUG] - Drift-Aware Change Sets can not properly recreate deleted(drifted) email subscription
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SNS::Subscription
### Resource Name
_No response_
### Issue Description
When an AWS::SNS::Subscription (email type) resource is detected as deleted drift, executing a Drift-Aware Change Set with REVERT_DRIFT does not properly recreate the subscription, even though the stack template is unchanged and the change set executes successfully.
### Expected Behavior
AWS::SNS::Subscription is recreated in pending status and can be validated and be used
### Observed Behavior
After executing the drift-aware change set:
- The SNS subscription is not recreated correctly
- The resource remains missing or non-functional
- No clear error is reported during change set execution
### Test Cases
initial template:
`{
"Resources": {
"TopicEF3BFD65": {
"Type": "AWS::SNS::Topic",
"Properties": {
"TopicName": "Topic-dev-cli",
"TracingConfig": "Active"
},
"Metadata": {
"aws:cdk:path": "dev-cli/Topic/Resource"
}
},
"Topicsupport5D627FC9": {
"Type": "AWS::SNS::Subscription",
"Properties": {
"Endpoint": "support.leo.development@xxxxxxxx.de",
"Protocol": "email",
"TopicArn": {
"Ref": "TopicEF3BFD65"
}
},
"Metadata": {
"aws:cdk:path": "dev-cli/Topic/support.leo.development@xxxxxxxx.de/Resource"
}
},
"XRayResourcePolicyForSnsTopic": {
"Type": "AWS::XRay::ResourcePolicy",
"Properties": {
"PolicyDocument": {
"Fn::Join": [
"",
[
"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"*\"],\"Action\":[\"xray:PutTraceSegments\",\"xray:GetSamplingRules\",\"xray:GetSamplingTargets\"],\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Condition\":{\"StringLike\":{\"aws:SourceArn\":\"",
{
"Ref": "TopicEF3BFD65"
},
"\"},\"StringEquals\":{\"aws:SourceAccount\":\"707520404616\"}},\"Effect\":\"Allow\"}]}"
]
]
},
"PolicyName": "XRayResourcePolicyForSnsTopic"
},
"Metadata": {
"aws:cdk:path": "dev-cli/XRayResourcePolicyForSnsTopic"
}
},
"xxxSupportEmailIdentity59F7189C": {
"Type": "AWS::SES::EmailIdentity",
"Properties": {
"EmailIdentity": "support.leo.development@xxxxxxxx.de"
},
"Metadata": {
"aws:cdk:path": "dev-cli/xxxSupportEmailIdentity/Resource"
}
},
"ApplicationSignalsServiceRole": {
"Type": "AWS::ApplicationSignals::Discovery",
"Metadata": {
"aws:cdk:path": "dev-cli/ApplicationSignalsServiceRole"
}
},
"CDKMetadata": {
"Type": "AWS::CDK::Metadata",
"Properties": {
"Analytics": "v2:deflate64:H4sIAAAAAAAA/1WMMQ+CMBCFfwt7qdjNWR100YC7OUo1J6Vtei1KCP/dNiw63Xtf3n2CC1HxqoA3lbLrS40tn5sAsmcJ3WcyxOebdSjZ/mHW0MSWpEcX0JpMf/vCPh4mnmityEYv1dVqlBMjlUTHAVCfOmUChim//oGFgXNpDFlE+DSgKZsOSNKOyqdBapcYXAwLO8MIG7HlFd8VL0IsfUyWQfF6vV+3iNbP2gAAAA=="
},
"Metadata": {
"aws:cdk:path": "dev-cli/CDKMetadata/Default"
}
}
},
"Outputs": {
"ExportsOutputRefTopicEF3BFD659F9AC892": {
"Value": {
"Ref": "TopicEF3BFD65"
},
"Export": {
"Name": "dev-cli:ExportsOutputRefTopicEF3BFD659F9AC892"
}
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}`
Resource drift overview:
Type
AWS::SNS::Topic
Expected
`{
"Subscription": [
{
"Endpoint": "support.leo.development@xxxxxxxx.de",
"Protocol": "email"
}
],
"TracingConfig": "Active",
"TopicName": "Topic-dev-cli"
}`
Actual:
`{
"TracingConfig": "Active",
"TopicName": "Topic-dev-cli"
}`
Create and execute a Drift-Aware Change Set using the previous template:
`aws cloudformation create-change-set --stack-name diverse-dev-cli --change-set-name drift-aware-changeset --use-previous-template --deployment-mode REVERT_DRIFT --capabilities CAPABILITY_IAM --profile dev-cli-adm
aws cloudformation execute-change-set --change-set-name drift-aware-changeset --stack-name diverse-dev-cli --profile dev-cli-adm`
### Other Details
_No response_
Contributor guide
Research direction
No repository file or test is named. Start by reproducing the reported workflow with the supplied template and the create-change-set and execute-change-set commands, then compare the subscription's drift and post-execution state. Done means the deleted email subscription is recreated in pending status and can be validated and used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100