aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::DMS::ReplicationSubnetGroup - [BUG] - False-positive drift on ReplicationSubnetGroupIdentifier (service lowercases the identifier)

Open
#2,560 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::DMS::ReplicationSubnetGroup

### Resource Name

_No response_

### Issue Description

Drift detection reports a false-positive drift on the `ReplicationSubnetGroupIdentifier` property of `AWS::DMS::ReplicationSubnetGroup`. If the template sets the identifier with any upper-case letters, DMS stores it in lower case on create. Drift detection then compares the mixed-case template value against the lower-cased value from the service and reports drift, although nothing actually changed after deployment.

### Expected Behavior

The stack stays `IN_SYNC`. Drift detection should take the DMS lower-casing of `ReplicationSubnetGroupIdentifier` into account (for example via a property transform in the resource schema), so a mixed-case template value is not reported as drift.

### Observed Behavior

The identifier is written in mixed case in the template, DMS stores it in lower case, and drift detection flags `/ReplicationSubnetGroupIdentifier` as changed. Drift output from a freshly deployed stack, no manual changes:

```json
[
{
"LID": "ReplicationSubnetGroup",
"Type": "AWS::DMS::ReplicationSubnetGroup",
"Diffs": [
{
"PropertyPath": "/ReplicationSubnetGroupIdentifier",
"ExpectedValue": "DMS-Drift-Repro-SubnetGroup",
"ActualValue": "dms-drift-repro-subnetgroup",
"DifferenceType": "NOT_EQUAL"
}
]
}
]
```

### Test Cases

This template is self-contained: it creates its own VPC and two subnets, needs no parameters, has no running cost, and needs no database. Deploy it in any region.

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Repro - false-positive drift on DMS ReplicationSubnetGroupIdentifier (service lowercases the identifier)

Resources:
Vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16

Subnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.0.1.0/24
AvailabilityZone: !Select [0, !GetAZs '']

Subnet2:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.0.2.0/24
AvailabilityZone: !Select [1, !GetAZs '']

ReplicationSubnetGroup:
Type: AWS::DMS::ReplicationSubnetGroup
Properties:
ReplicationSubnetGroupIdentifier: DMS-Drift-Repro-SubnetGroup
ReplicationSubnetGroupDescription: Repro for identifier casing drift
SubnetIds:
- !Ref Subnet1
- !Ref Subnet2
```

Steps:

1. Deploy the stack and wait for `CREATE_COMPLETE`.
2. Run drift detection (Console: Stack actions -> Detect drift, or CLI `detect-stack-drift`).
3. Look at the drift details.

The stack goes to `DRIFTED` and `ReplicationSubnetGroup` shows `MODIFIED` on `/ReplicationSubnetGroupIdentifier`, with the expected value in mixed case and the actual value in lower case.

Drift Details AWS Console

### Other Details

Companion issue for the same DMS identifier lower-casing behaviour on `AWS::DMS::ReplicationTask` (`ReplicationTaskIdentifier`): #2561.

AWS Support Case: 178853082300312

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named. Start by locating the AWS::DMS::ReplicationSubnetGroup resource schema and its drift or property-transform tests, then reproduce the issue with the self-contained YAML template and drift-detection steps. Done means mixed-case ReplicationSubnetGroupIdentifier values remain IN_SYNC after DMS lowercases them, with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.