aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::EC2::VolumeAttachment] - [BUG] - Drift-Aware ChangeSets incorrectly report drift on EC2 instances with volume attachments

Open
#2,465 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::VolumeAttachment

### Resource Name

_No response_

### Issue Description

Drift-Aware ChangeSets (using REVERT_DRIFT deployment mode) are incorrectly reporting drift on AWS::EC2::Instance resources when AWS::EC2::VolumeAttachment resources are present in the stack, even when no actual drift exists. This causes changeset creation to fail with the error: "The submitted information requires replacement of drifted resources, which is not supported. Resolve drift before changing immutable resource properties"

Affected Resource Types:
AWS::EC2::Instance (incorrectly reported as drifted)
AWS::EC2::VolumeAttachment (incorrectly flagged for replacement)
AWS::EC2::Volume (indirectly affected)

### Expected Behavior

When creating a Drift-Aware Changeset with --deployment-mode REVERT_DRIFT:
1. CloudFormation should correctly identify the relationship between AWS::EC2::Instance and AWS::EC2::VolumeAttachment resources
2. If no actual drift exists (confirmed via detect-stack-drift), the changeset should:
- Show all resources as IN_SYNC
- Not report false drift on EC2 instances
- Not suggest replacement of volume attachments
3. The changeset should either:
- Complete successfully with zero changes (if templates are identical)
- Show only actual drifted properties that need remediation
- The BlockDeviceMappings property on EC2 instances should correctly reflect attached volumes defined via AWS::EC2::VolumeAttachment resources

### Observed Behavior

When creating a Drift-Aware Changeset with --deployment-mode REVERT_DRIFT:
1. False Drift Detection: EC2 instances are incorrectly reported as "Drifted" even when detect-stack-drift shows IN_SYNC
2. Incorrect Replacement Policy: Volume attachments show policy action "ReplaceAndDelete" despite no changes in the template
3. Changeset Failure: Changeset creation fails with error: "The submitted information requires replacement of drifted resources, which is not supported. Resolve drift before changing immutable resource properties"
4. BlockDeviceMappings Mismatch: The drift detection shows differences in BlockDeviceMappings ordering between expected and actual state, even though the volumes are identical (just in different order)

### Test Cases

Using a minimal template:
```
Resources:
TestInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-0c55b159cbfafe1f0
InstanceType: t3.micro
Tags:
- Key: Name
Value: DriftTestInstance

TestVolume:
Type: AWS::EC2::Volume
DeletionPolicy: Snapshot
Properties:
AvailabilityZone: !GetAtt TestInstance.AvailabilityZone
Size: 10
VolumeType: gp3

AttachTestVolume:
Type: AWS::EC2::VolumeAttachment
Properties:
Device: /dev/sdf
InstanceId: !Ref TestInstance
VolumeId: !Ref TestVolume
```
Create a Drift-Aware Changeset with no template changes:
aws cloudformation create-change-set \
--stack-name test-stack \
--change-set-name test-drift-aware \
--use-previous-template \
--deployment-mode REVERT_DRIFT

Changeset fails with "replacement of drifted resources" error

### Other Details

Workaround: Use standard changesets (without --deployment-mode REVERT_DRIFT)

Contributor guide

Open the contributing guide

Research direction

Start with the minimal CloudFormation template in the issue and run detect-stack-drift, then create the change set with --deployment-mode REVERT_DRIFT and --use-previous-template. Compare the reported resource statuses, replacement action, and BlockDeviceMappings ordering. Done means an unchanged stack is not falsely drifted and the change set does not fail for replacement of drifted resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.