aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::DMS::Endpoint - [BUG] - False-positive drift on S3Settings.CompressionType (actual value reported lower-cased, resource is in sync)

Open
#2,566 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::DMS::Endpoint

### Resource Name

_No response_

### Issue Description

Drift detection reports a false-positive drift on `S3Settings.CompressionType` of `AWS::DMS::Endpoint`. The template sets `CompressionType: GZIP`. Drift detection reports the property as `MODIFIED` with `ExpectedValue: GZIP` and `ActualValue: gzip`.

However, the actual value in the service is not lower-cased. `dms describe-endpoints` returns `CompressionType: GZIP` for the same endpoint. So the template and the real resource state are identical (`GZIP`), and the lower-cased `gzip` only appears in the drift result. The resource is effectively in sync, but drift detection reports a difference.

### Expected Behavior

The stack stays `IN_SYNC`, because the template value (`GZIP`) and the actual value returned by the DMS API (`GZIP`) are the same. Drift detection should not report `/S3Settings/CompressionType` as changed.

### Observed Behavior

Drift detection reports `MODIFIED` with an actual value that does not match what the service actually stores.

Drift output from a freshly deployed stack (us-east-1), no manual changes:

```json
{
"LogicalResourceId": "S3TargetEndpoint",
"ResourceType": "AWS::DMS::Endpoint",
"PropertyDifferences": [
{
"PropertyPath": "/S3Settings/CompressionType",
"ExpectedValue": "GZIP",
"ActualValue": "gzip",
"DifferenceType": "NOT_EQUAL"
}
],
"StackResourceDriftStatus": "MODIFIED"
}
```

The DMS API for the same endpoint returns the value unchanged (upper case):

```
aws dms describe-endpoints --query "Endpoints[?EngineName=='s3'].{Id:EndpointIdentifier,Comp:S3Settings.CompressionType}"
-> Comp = GZIP
```

So template = `GZIP`, service = `GZIP`, but drift reports actual = `gzip`.

### Test Cases

This template is self-contained: an S3 bucket, an IAM role for DMS, and one S3 target endpoint using `CompressionType: GZIP`. No replication instance or database needed. Deploy with `--capabilities CAPABILITY_IAM`.

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Repro - false-positive drift on DMS Endpoint S3Settings.CompressionType (actual reported as gzip while service has GZIP)

Resources:
DataBucket:
Type: AWS::S3::Bucket

DmsS3Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: dms.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: s3-access
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:PutObject
- s3:GetObject
- s3:DeleteObject
- s3:ListBucket
Resource:
- !GetAtt DataBucket.Arn
- !Sub '${DataBucket.Arn}/*'

S3TargetEndpoint:
Type: AWS::DMS::Endpoint
Properties:
EndpointType: target
EngineName: s3
S3Settings:
BucketName: !Ref DataBucket
ServiceAccessRoleArn: !GetAtt DmsS3Role.Arn
CompressionType: GZIP
```

Steps:

1. Deploy the stack and wait for `CREATE_COMPLETE`.
2. Run drift detection (Console: Stack actions -> Detect drift, or CLI `detect-stack-drift`).
3. Compare the drift result with `aws dms describe-endpoints` for the same endpoint.

Drift reports `MODIFIED` on `/S3Settings/CompressionType` (`GZIP` -> `gzip`), while the DMS API returns `GZIP`, so the resource is actually in sync.

### Other Details

Verified in `us-east-1` with a freshly deployed stack; no manual changes were made before running drift detection. The key point is that the drift result reports an actual value (`gzip`) that differs from what the DMS API actually returns (`GZIP`), so the resource is in sync but is reported as drifted. AWS Support case 178853082300312 tracks this internally.

Contributor guide

Open the contributing guide

Research direction

Start with the self-contained YAML template in the issue, deploy it in us-east-1, and run detect-stack-drift. Compare the drift result for /S3Settings/CompressionType with aws dms describe-endpoints. Done means the endpoint is reported IN_SYNC and no difference is shown when both values are GZIP.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.