aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Manually applied AWS managed and Customer managed policies not detected in drift results on AWS::IAM::Role
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::Role
### Issue Description
Drift detection does not detect that an IAM role resource is drifted, when AWS managed and Customer managed policies are applied out-of-band / outside of CloudFormation.
### Expected Behavior
The values returned in the drift report should reflect the policies applied on the physical resource and show that the resource is DRIFTED, but instead it shows IN_SYNC.
### Observed Behavior
There is no drift detected. There might be an issue with the drift evaluation workflow.
### Test Cases
1. Deploy a stack with the following template:
```
Resources:
testRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
```
2. Manually add an AWS managed and / or customer managed policy onto the role in the IAM console
3. Run drift detection on the stack
Contributor guide
Research direction
Start with the issue's CloudFormation drift-detection reproduction: deploy the stated AWS::IAM::Role template, attach an AWS managed or customer managed policy in the IAM console, and run drift detection. Done means the drift report reflects the physical policies and marks the resource DRIFTED; no repository file or test entry point is identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100