aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::SageMaker::Domain - [BUG] - False positive drift for RStudioServerProAppSettings property

Open
#2,494 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SageMaker::Domain

### Resource Name

_No response_

### Issue Description

Creating a new stack with the AWS::SageMaker::Domain resource and including the RStudioServerProAppSettings property with {AccessStatus: DISABLED} in the template, running a drift detection on the stack then reports the sagemaker domain as MODIFIED with RStudioServerProAppSettings flagged as "REMOVED"

### Expected Behavior

No drift should be seen

### Observed Behavior

Drift detection shows Sagemaker domain as MODIFIED with RStudioServerProAppSettings flagged as "REMOVED"

### Test Cases

Create a new stack with the AWS::SageMaker::Domain resource and include the RStudioServerProAppSettings property with {AccessStatus: DISABLED} in the template. Once stack is created, the drift status should already show as modified - running a drift detection and viewing results will show the RStudioServerProAppSettings property as removed.

Example template below:
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Self-contained SageMaker Domain with RStudioServerPro disabled",
"Resources": {
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "<>",
"EnableDnsSupport": true,
"EnableDnsHostnames": true
}
},
"Subnet": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPC"
},
"CidrBlock": "<>"
}
},
"SageMakerExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "sagemaker.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
},
"SageMakerDomain": {
"Type": "AWS::SageMaker::Domain",
"Properties": {
"AuthMode": "IAM",
"DefaultUserSettings": {
"ExecutionRole": {
"Fn::GetAtt": [
"SageMakerExecutionRole",
"Arn"
]
},
"RStudioServerProAppSettings": {
"AccessStatus": "DISABLED"
}
},
"DomainName": "sagemaker-domain",
"SubnetIds": [
{
"Ref": "Subnet"
}
],
"VpcId": {
"Ref": "VPC"
}
}
}
}
}
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the provided AWS::SageMaker::Domain template and run CloudFormation drift detection. Compare the declared RStudioServerProAppSettings value with the reported resource state; done means AccessStatus: DISABLED is not reported as removed and the stack shows no drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.