aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[Resource Type] - [Enhancement] - AWS::StepFunctions::StateMachine — Drift detection false positive when using DefinitionSubstitutions

Open
#2,562 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::StepFunctions::StateMachine

### Resource name

_No response_

### Description

**Summary**

_Drift detection incorrectly reports MODIFIED for AWS::StepFunctions::StateMachine resources that use DefinitionSubstitutions. This is a false positive._

**Root cause**

CloudFormation records the unresolved definition (with ${Placeholder} tokens intact) as the expected value for /DefinitionString. The Step Functions resource provider resolves substitutions at create/update time, so the read handler returns the fully resolved definition. Drift detection then compares these two unequal strings and reports MODIFIED, even though nothing has changed.

**Reproduction**

```
Resources:
NoOp:
Type: AWS::StepFunctions::StateMachine
Properties:
RoleArn: !GetAtt StateMachineExecutionRole.Arn
DefinitionString: |
{
"Comment": "Simple step function in region ${TestValue}.",
"StartAt": "Success",
"States": { "Success": { "Type": "Succeed" } }
}
DefinitionSubstitutions:
TestValue: !Ref AWS::Region
```

After deploying and running drift detection:
```
PropertyPath: /DefinitionString
DifferenceType: NOT_EQUAL
EXPECTED: { "Comment": "Simple step function in region ${TestValue}.", ... }
ACTUAL: { "Comment": "Simple step function in region eu-west-1.", ... }
```

**Confirmed workaround**

Replace DefinitionSubstitutions with Fn::Sub. CloudFormation resolves the definition before recording the expected value, so drift detection compares like with like and reports IN_SYNC.
```
DefinitionString: !Sub |
{
"Comment": "Simple step function in region ${AWS::Region}.",
"StartAt": "Success",
"States": { "Success": { "Type": "Succeed" } }
}
```

Fn::Sub supports ${Resource.Attr} syntax, so DefinitionSubstitutions entries using !GetAtt map directly (e.g. ${PlaceholderLambda.Arn}).

**Expected fix**

Either a propertyTransform in the AWS::StepFunctions::StateMachine schema (as described in the [resource type false drift docs](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-model-false-drift.html)), or a read handler change that returns the unresolved definition string.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by deploying the supplied AWS::StepFunctions::StateMachine reproduction with DefinitionSubstitutions and running drift detection; compare the expected and actual /DefinitionString values. Consult the linked resource-type false-drift documentation, then investigate the StateMachine schema's propertyTransform or read handler. Done means the unchanged resource reports IN_SYNC while preserving substitution behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.