aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::DMS::Endpoint - [BUG] - False-positive drift on S3Settings.CompressionType (actual value reported lower-cased, resource is in sync)
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::DMS::Endpoint
### Resource Name
_No response_
### Issue Description
Drift detection reports a false-positive drift on `S3Settings.CompressionType` of `AWS::DMS::Endpoint`. The template sets `CompressionType: GZIP`. Drift detection reports the property as `MODIFIED` with `ExpectedValue: GZIP` and `ActualValue: gzip`.
However, the actual value in the service is not lower-cased. `dms describe-endpoints` returns `CompressionType: GZIP` for the same endpoint. So the template and the real resource state are identical (`GZIP`), and the lower-cased `gzip` only appears in the drift result. The resource is effectively in sync, but drift detection reports a difference.
### Expected Behavior
The stack stays `IN_SYNC`, because the template value (`GZIP`) and the actual value returned by the DMS API (`GZIP`) are the same. Drift detection should not report `/S3Settings/CompressionType` as changed.
### Observed Behavior
Drift detection reports `MODIFIED` with an actual value that does not match what the service actually stores.
Drift output from a freshly deployed stack (us-east-1), no manual changes:
```json
{
"LogicalResourceId": "S3TargetEndpoint",
"ResourceType": "AWS::DMS::Endpoint",
"PropertyDifferences": [
{
"PropertyPath": "/S3Settings/CompressionType",
"ExpectedValue": "GZIP",
"ActualValue": "gzip",
"DifferenceType": "NOT_EQUAL"
}
],
"StackResourceDriftStatus": "MODIFIED"
}
```
The DMS API for the same endpoint returns the value unchanged (upper case):
```
aws dms describe-endpoints --query "Endpoints[?EngineName=='s3'].{Id:EndpointIdentifier,Comp:S3Settings.CompressionType}"
-> Comp = GZIP
```
So template = `GZIP`, service = `GZIP`, but drift reports actual = `gzip`.
### Test Cases
This template is self-contained: an S3 bucket, an IAM role for DMS, and one S3 target endpoint using `CompressionType: GZIP`. No replication instance or database needed. Deploy with `--capabilities CAPABILITY_IAM`.
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Repro - false-positive drift on DMS Endpoint S3Settings.CompressionType (actual reported as gzip while service has GZIP)
Resources:
DataBucket:
Type: AWS::S3::Bucket
DmsS3Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: dms.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: s3-access
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:PutObject
- s3:GetObject
- s3:DeleteObject
- s3:ListBucket
Resource:
- !GetAtt DataBucket.Arn
- !Sub '${DataBucket.Arn}/*'
S3TargetEndpoint:
Type: AWS::DMS::Endpoint
Properties:
EndpointType: target
EngineName: s3
S3Settings:
BucketName: !Ref DataBucket
ServiceAccessRoleArn: !GetAtt DmsS3Role.Arn
CompressionType: GZIP
```
Steps:
1. Deploy the stack and wait for `CREATE_COMPLETE`.
2. Run drift detection (Console: Stack actions -> Detect drift, or CLI `detect-stack-drift`).
3. Compare the drift result with `aws dms describe-endpoints` for the same endpoint.
Drift reports `MODIFIED` on `/S3Settings/CompressionType` (`GZIP` -> `gzip`), while the DMS API returns `GZIP`, so the resource is actually in sync.
### Other Details
Verified in `us-east-1` with a freshly deployed stack; no manual changes were made before running drift detection. The key point is that the drift result reports an actual value (`gzip`) that differs from what the DMS API actually returns (`GZIP`), so the resource is in sync but is reported as drifted. AWS Support case 178853082300312 tracks this internally.
Contributor guide
Research direction
Start with the self-contained YAML template in the issue, deploy it in us-east-1, and run detect-stack-drift. Compare the drift result for /S3Settings/CompressionType with aws dms describe-endpoints. Done means the endpoint is reported IN_SYNC and no difference is shown when both values are GZIP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100