aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::SageMaker::Domain - [BUG] - False positive drift for RStudioServerProAppSettings property
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SageMaker::Domain
### Resource Name
_No response_
### Issue Description
Creating a new stack with the AWS::SageMaker::Domain resource and including the RStudioServerProAppSettings property with {AccessStatus: DISABLED} in the template, running a drift detection on the stack then reports the sagemaker domain as MODIFIED with RStudioServerProAppSettings flagged as "REMOVED"
### Expected Behavior
No drift should be seen
### Observed Behavior
Drift detection shows Sagemaker domain as MODIFIED with RStudioServerProAppSettings flagged as "REMOVED"
### Test Cases
Create a new stack with the AWS::SageMaker::Domain resource and include the RStudioServerProAppSettings property with {AccessStatus: DISABLED} in the template. Once stack is created, the drift status should already show as modified - running a drift detection and viewing results will show the RStudioServerProAppSettings property as removed.
Example template below:
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Self-contained SageMaker Domain with RStudioServerPro disabled",
"Resources": {
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "<>",
"EnableDnsSupport": true,
"EnableDnsHostnames": true
}
},
"Subnet": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPC"
},
"CidrBlock": "<>"
}
},
"SageMakerExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "sagemaker.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
},
"SageMakerDomain": {
"Type": "AWS::SageMaker::Domain",
"Properties": {
"AuthMode": "IAM",
"DefaultUserSettings": {
"ExecutionRole": {
"Fn::GetAtt": [
"SageMakerExecutionRole",
"Arn"
]
},
"RStudioServerProAppSettings": {
"AccessStatus": "DISABLED"
}
},
"DomainName": "sagemaker-domain",
"SubnetIds": [
{
"Ref": "Subnet"
}
],
"VpcId": {
"Ref": "VPC"
}
}
}
}
}
```
### Other Details
_No response_
Contributor guide
Research direction
Start by reproducing the issue with the provided AWS::SageMaker::Domain template and run CloudFormation drift detection. Compare the declared RStudioServerProAppSettings value with the reported resource state; done means AccessStatus: DISABLED is not reported as removed and the stack shows no drift.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100