aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ImageBuilder::ImageRecipe] - [BUG] - Drift Detection does not recognize version with new wildcard 'x' and results drifted stack

Open
#2,522 1 comment 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ImageBuilder::ImageRecipe

### Resource Name

_No response_

### Issue Description

The `AWS::ImageBuilder::ImageRecipe` resource supports semantic version wildcards (`x`) in the `Version` property, as documented in the [Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/create-image-recipes.html). When using a wildcard like `1.0.x`, Image Builder resolves it to the next available version (e.g. `1.0.12`) at creation time.

However, CloudFormation Drift Detection compares the template value (`1.0.x`) against the resolved actual value (`1.0.12`) as a **literal string comparison**, resulting in a false-positive drift of `MODIFIED`.

### Expected Behavior

Drift Detection should recognize that `1.0.x` is a wildcard pattern and that `1.0.12` matches it. No drift should be reported. CFN must support: https://aws.amazon.com/about-aws/whats-new/2025/11/ec2-image-builder-auto-versioning-infrastructure/

### Observed Behavior

Drift Detection reports:
- **Property:** `Version`
- **Status:** MODIFIED
- **Expected value:** `1.0.x`
- **Current value:** `1.0.12`

### Test Cases

1. Create a stack with an `AWS::ImageBuilder::ImageRecipe` using a wildcard version:

```yaml
Resources:
TestRecipe:
Type: AWS::ImageBuilder::ImageRecipe
Properties:
Name: test-wildcard-drift
Version: "1.0.x"
ParentImage: arn:aws:imagebuilder:eu-central-1:aws:image/amazon-linux-2023-x86/x.x.x
Components:
- ComponentArn: arn:aws:imagebuilder:eu-central-1:aws:component/update-linux/x.x.x
```

2. Deploy the stack successfully.
3. Run Drift Detection on the stack.
4. The `ImageRecipe` resource is reported as `MODIFIED` because `Version` expected `1.0.x` but actual is `1.0.`.

### Other Details

- The same wildcard pattern is used in `ParentImage` and `ComponentArn` (e.g. `x.x.x`) – it is unclear whether those also trigger drift, but `Version` definitely does.
- This is a documented feature of Image Builder: https://docs.aws.amazon.com/imagebuilder/latest/userguide/create-image-recipes.html
- The drift makes it impossible to maintain a drift-free stack when using the recommended wildcard versioning pattern.

The Drift Detection handler for `AWS::ImageBuilder::ImageRecipe` should treat `x` in a version string as a wildcard that matches any numeric segment, consistent with how the Create handler resolves it.

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::ImageBuilder::ImageRecipe Drift Detection handler and compare its Version comparison with the Create handler's wildcard behavior. Use the supplied 1.0.x and resolved 1.0.12 case to verify the comparison, then confirm that matching wildcard versions no longer report MODIFIED drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.