aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[Resource Type] - [Enhancement] - AWS::StepFunctions::StateMachine — Drift detection false positive when using DefinitionSubstitutions
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::StepFunctions::StateMachine
### Resource name
_No response_
### Description
**Summary**
_Drift detection incorrectly reports MODIFIED for AWS::StepFunctions::StateMachine resources that use DefinitionSubstitutions. This is a false positive._
**Root cause**
CloudFormation records the unresolved definition (with ${Placeholder} tokens intact) as the expected value for /DefinitionString. The Step Functions resource provider resolves substitutions at create/update time, so the read handler returns the fully resolved definition. Drift detection then compares these two unequal strings and reports MODIFIED, even though nothing has changed.
**Reproduction**
```
Resources:
NoOp:
Type: AWS::StepFunctions::StateMachine
Properties:
RoleArn: !GetAtt StateMachineExecutionRole.Arn
DefinitionString: |
{
"Comment": "Simple step function in region ${TestValue}.",
"StartAt": "Success",
"States": { "Success": { "Type": "Succeed" } }
}
DefinitionSubstitutions:
TestValue: !Ref AWS::Region
```
After deploying and running drift detection:
```
PropertyPath: /DefinitionString
DifferenceType: NOT_EQUAL
EXPECTED: { "Comment": "Simple step function in region ${TestValue}.", ... }
ACTUAL: { "Comment": "Simple step function in region eu-west-1.", ... }
```
**Confirmed workaround**
Replace DefinitionSubstitutions with Fn::Sub. CloudFormation resolves the definition before recording the expected value, so drift detection compares like with like and reports IN_SYNC.
```
DefinitionString: !Sub |
{
"Comment": "Simple step function in region ${AWS::Region}.",
"StartAt": "Success",
"States": { "Success": { "Type": "Succeed" } }
}
```
Fn::Sub supports ${Resource.Attr} syntax, so DefinitionSubstitutions entries using !GetAtt map directly (e.g. ${PlaceholderLambda.Arn}).
**Expected fix**
Either a propertyTransform in the AWS::StepFunctions::StateMachine schema (as described in the [resource type false drift docs](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model-false-drift.html)), or a read handler change that returns the unresolved definition string.
### Other Details
_No response_
Contributor guide
Research direction
Start by deploying the supplied AWS::StepFunctions::StateMachine reproduction with DefinitionSubstitutions and running drift detection; compare the expected and actual /DefinitionString values. Consult the linked resource-type false-drift documentation, then investigate the StateMachine schema's propertyTransform or read handler. Done means the unchanged resource reports IN_SYNC while preserving substitution behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100