aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::DMS::Endpoint - [BUG] - False-positive drift on EndpointIdentifier (service lowercases the identifier)

Open
#2,565 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::DMS::Endpoint

### Resource Name

_No response_

### Issue Description

Drift detection reports a false-positive drift on the `EndpointIdentifier` property of `AWS::DMS::Endpoint`. If the template sets the identifier with any upper-case letters, DMS stores it in lower case on create. Drift detection then compares the mixed-case template value against the lower-cased value from the service and reports drift, although nothing actually changed after deployment.

### Expected Behavior

The stack stays `IN_SYNC`. Drift detection should take the DMS lower-casing of `EndpointIdentifier` into account (for example via a property transform in the resource schema), so a mixed-case template value is not reported as drift.

### Observed Behavior

The identifier is written in mixed case in the template, DMS stores it in lower case, and drift detection flags `/EndpointIdentifier` as changed. Drift output from a freshly deployed stack (us-east-1), no manual changes:

```json
{
"LogicalResourceId": "EndpointMixedCaseId",
"ResourceType": "AWS::DMS::Endpoint",
"PropertyDifferences": [
{
"PropertyPath": "/EndpointIdentifier",
"ExpectedValue": "DMS-Drift-Repro-Endpoint-01",
"ActualValue": "dms-drift-repro-endpoint-01",
"DifferenceType": "NOT_EQUAL"
}
],
"StackResourceDriftStatus": "MODIFIED"
}
```

### Test Cases

This template is self-contained: one mysql source endpoint with a placeholder host (only created, never connected). No replication instance, no database needed. Deploy it in any region.

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Repro - false-positive drift on DMS Endpoint EndpointIdentifier (service lowercases the identifier)

Resources:
EndpointMixedCaseId:
Type: AWS::DMS::Endpoint
Properties:
EndpointIdentifier: DMS-Drift-Repro-Endpoint-01
EndpointType: source
EngineName: mysql
ServerName: a.example.invalid
Port: 3306
Username: repro
Password: ReproPlaceholder123
```

Steps:

1. Deploy the stack and wait for `CREATE_COMPLETE`.
2. Run drift detection (Console: Stack actions -> Detect drift, or CLI `detect-stack-drift`).
3. Look at the drift details.

The stack goes to `DRIFTED` and `EndpointMixedCaseId` shows `MODIFIED` on `/EndpointIdentifier`, with the expected value in mixed case and the actual value in lower case.

### Other Details

Verified in `us-east-1` with a freshly deployed stack; no manual changes were made before running drift detection. Same underlying pattern as #2560 (`ReplicationSubnetGroupIdentifier`) and #2561 (`ReplicationTaskIdentifier`): DMS lower-cases the identifier on create. AWS Support case 178853082300312 tracks this internally.

Contributor guide

Open the contributing guide

Research direction

Start with the self-contained CloudFormation YAML in the issue, deploy it, and run stack drift detection to reproduce the `/EndpointIdentifier` difference. Investigate the resource schema or drift-handling entry point for AWS::DMS::Endpoint; done means a mixed-case template identifier remains IN_SYNC after DMS stores it in lowercase.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.