aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::DMS::ReplicationSubnetGroup - [BUG] - False-positive drift on ReplicationSubnetGroupIdentifier (service lowercases the identifier)
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::DMS::ReplicationSubnetGroup
### Resource Name
_No response_
### Issue Description
Drift detection reports a false-positive drift on the `ReplicationSubnetGroupIdentifier` property of `AWS::DMS::ReplicationSubnetGroup`. If the template sets the identifier with any upper-case letters, DMS stores it in lower case on create. Drift detection then compares the mixed-case template value against the lower-cased value from the service and reports drift, although nothing actually changed after deployment.
### Expected Behavior
The stack stays `IN_SYNC`. Drift detection should take the DMS lower-casing of `ReplicationSubnetGroupIdentifier` into account (for example via a property transform in the resource schema), so a mixed-case template value is not reported as drift.
### Observed Behavior
The identifier is written in mixed case in the template, DMS stores it in lower case, and drift detection flags `/ReplicationSubnetGroupIdentifier` as changed. Drift output from a freshly deployed stack, no manual changes:
```json
[
{
"LID": "ReplicationSubnetGroup",
"Type": "AWS::DMS::ReplicationSubnetGroup",
"Diffs": [
{
"PropertyPath": "/ReplicationSubnetGroupIdentifier",
"ExpectedValue": "DMS-Drift-Repro-SubnetGroup",
"ActualValue": "dms-drift-repro-subnetgroup",
"DifferenceType": "NOT_EQUAL"
}
]
}
]
```
### Test Cases
This template is self-contained: it creates its own VPC and two subnets, needs no parameters, has no running cost, and needs no database. Deploy it in any region.
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Repro - false-positive drift on DMS ReplicationSubnetGroupIdentifier (service lowercases the identifier)
Resources:
Vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
Subnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.0.1.0/24
AvailabilityZone: !Select [0, !GetAZs '']
Subnet2:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.0.2.0/24
AvailabilityZone: !Select [1, !GetAZs '']
ReplicationSubnetGroup:
Type: AWS::DMS::ReplicationSubnetGroup
Properties:
ReplicationSubnetGroupIdentifier: DMS-Drift-Repro-SubnetGroup
ReplicationSubnetGroupDescription: Repro for identifier casing drift
SubnetIds:
- !Ref Subnet1
- !Ref Subnet2
```
Steps:
1. Deploy the stack and wait for `CREATE_COMPLETE`.
2. Run drift detection (Console: Stack actions -> Detect drift, or CLI `detect-stack-drift`).
3. Look at the drift details.
The stack goes to `DRIFTED` and `ReplicationSubnetGroup` shows `MODIFIED` on `/ReplicationSubnetGroupIdentifier`, with the expected value in mixed case and the actual value in lower case.
### Other Details
Companion issue for the same DMS identifier lower-casing behaviour on `AWS::DMS::ReplicationTask` (`ReplicationTaskIdentifier`): #2561.
AWS Support Case: 178853082300312
Contributor guide
Research direction
No repository file or test is named. Start by locating the AWS::DMS::ReplicationSubnetGroup resource schema and its drift or property-transform tests, then reproduce the issue with the self-contained YAML template and drift-detection steps. Done means mixed-case ReplicationSubnetGroupIdentifier values remain IN_SYNC after DMS lowercases them, with regression coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100