aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SNS::Subscription] - [BUG] - Drift-Aware Change Sets can not properly recreate deleted(drifted) email subscription

Open
#2,455 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SNS::Subscription

### Resource Name

_No response_

### Issue Description

When an AWS::SNS::Subscription (email type) resource is detected as deleted drift, executing a Drift-Aware Change Set with REVERT_DRIFT does not properly recreate the subscription, even though the stack template is unchanged and the change set executes successfully.

### Expected Behavior

AWS::SNS::Subscription is recreated in pending status and can be validated and be used

### Observed Behavior

After executing the drift-aware change set:

- The SNS subscription is not recreated correctly
- The resource remains missing or non-functional
- No clear error is reported during change set execution

### Test Cases

initial template:
`{
"Resources": {
"TopicEF3BFD65": {
"Type": "AWS::SNS::Topic",
"Properties": {
"TopicName": "Topic-dev-cli",
"TracingConfig": "Active"
},
"Metadata": {
"aws:cdk:path": "dev-cli/Topic/Resource"
}
},
"Topicsupport5D627FC9": {
"Type": "AWS::SNS::Subscription",
"Properties": {
"Endpoint": "support.leo.development@xxxxxxxx.de",
"Protocol": "email",
"TopicArn": {
"Ref": "TopicEF3BFD65"
}
},
"Metadata": {
"aws:cdk:path": "dev-cli/Topic/support.leo.development@xxxxxxxx.de/Resource"
}
},
"XRayResourcePolicyForSnsTopic": {
"Type": "AWS::XRay::ResourcePolicy",
"Properties": {
"PolicyDocument": {
"Fn::Join": [
"",
[
"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"*\"],\"Action\":[\"xray:PutTraceSegments\",\"xray:GetSamplingRules\",\"xray:GetSamplingTargets\"],\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Condition\":{\"StringLike\":{\"aws:SourceArn\":\"",
{
"Ref": "TopicEF3BFD65"
},
"\"},\"StringEquals\":{\"aws:SourceAccount\":\"707520404616\"}},\"Effect\":\"Allow\"}]}"
]
]
},
"PolicyName": "XRayResourcePolicyForSnsTopic"
},
"Metadata": {
"aws:cdk:path": "dev-cli/XRayResourcePolicyForSnsTopic"
}
},
"xxxSupportEmailIdentity59F7189C": {
"Type": "AWS::SES::EmailIdentity",
"Properties": {
"EmailIdentity": "support.leo.development@xxxxxxxx.de"
},
"Metadata": {
"aws:cdk:path": "dev-cli/xxxSupportEmailIdentity/Resource"
}
},
"ApplicationSignalsServiceRole": {
"Type": "AWS::ApplicationSignals::Discovery",
"Metadata": {
"aws:cdk:path": "dev-cli/ApplicationSignalsServiceRole"
}
},
"CDKMetadata": {
"Type": "AWS::CDK::Metadata",
"Properties": {
"Analytics": "v2:deflate64:H4sIAAAAAAAA/1WMMQ+CMBCFfwt7qdjNWR100YC7OUo1J6Vtei1KCP/dNiw63Xtf3n2CC1HxqoA3lbLrS40tn5sAsmcJ3WcyxOebdSjZ/mHW0MSWpEcX0JpMf/vCPh4mnmityEYv1dVqlBMjlUTHAVCfOmUChim//oGFgXNpDFlE+DSgKZsOSNKOyqdBapcYXAwLO8MIG7HlFd8VL0IsfUyWQfF6vV+3iNbP2gAAAA=="
},
"Metadata": {
"aws:cdk:path": "dev-cli/CDKMetadata/Default"
}
}
},
"Outputs": {
"ExportsOutputRefTopicEF3BFD659F9AC892": {
"Value": {
"Ref": "TopicEF3BFD65"
},
"Export": {
"Name": "dev-cli:ExportsOutputRefTopicEF3BFD659F9AC892"
}
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}`

Resource drift overview:
Type
AWS::SNS::Topic
Expected
`{
"Subscription": [
{
"Endpoint": "support.leo.development@xxxxxxxx.de",
"Protocol": "email"
}
],
"TracingConfig": "Active",
"TopicName": "Topic-dev-cli"
}`

Actual:
`{
"TracingConfig": "Active",
"TopicName": "Topic-dev-cli"
}`

Create and execute a Drift-Aware Change Set using the previous template:
`aws cloudformation create-change-set --stack-name diverse-dev-cli --change-set-name drift-aware-changeset --use-previous-template --deployment-mode REVERT_DRIFT --capabilities CAPABILITY_IAM --profile dev-cli-adm

aws cloudformation execute-change-set --change-set-name drift-aware-changeset --stack-name diverse-dev-cli --profile dev-cli-adm`

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named. Start by reproducing the reported workflow with the supplied template and the create-change-set and execute-change-set commands, then compare the subscription's drift and post-execution state. Done means the deleted email subscription is recreated in pending status and can be validated and used.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.