aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Manually applied AWS managed and Customer managed policies not detected in drift results on AWS::IAM::Role

Open
#2,489 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::Role

### Issue Description

Drift detection does not detect that an IAM role resource is drifted, when AWS managed and Customer managed policies are applied out-of-band / outside of CloudFormation.

### Expected Behavior

The values returned in the drift report should reflect the policies applied on the physical resource and show that the resource is DRIFTED, but instead it shows IN_SYNC.

### Observed Behavior

There is no drift detected. There might be an issue with the drift evaluation workflow.

### Test Cases

1. Deploy a stack with the following template:

```
Resources:
testRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
```

2. Manually add an AWS managed and / or customer managed policy onto the role in the IAM console
3. Run drift detection on the stack

Contributor guide

Open the contributing guide

Research direction

Start with the issue's CloudFormation drift-detection reproduction: deploy the stated AWS::IAM::Role template, attach an AWS managed or customer managed policy in the IAM console, and run drift detection. Done means the drift report reflects the physical policies and marks the resource DRIFTED; no repository file or test entry point is identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.