aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Drift detection can't detect inline policies added to an IAM Role.

Open
#936 2 comments 12 reactions 0 assignees View on GitHub
bug NeedTriage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::Role

### Resource Name

AWS::IAM::Role

### Issue Description

If an inline policy is added to an IAM role, drift detection should pick that up as drift (because the permissions of the role have materially changed).

### Expected Behavior

Drift detection should mark the resource as 'MODIFIED' and thus the stack as 'DRIFTED'.

### Observed Behavior

Drift detection marks the resource and stack as 'IN_SYNC'.

### Test Cases

1. Deploy a stack with the following template:
```
Resources:
testRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
```
1. Manually add an inline policy to the role in the IAM console
1. Run drift detect
1. Note that drift detection doesn't pick up the added policy

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue names AWS::IAM::Role but provides no repository files or tests. Reproduce the listed case by deploying the template, adding an inline policy in IAM, and running drift detection; done means the role is marked MODIFIED and the stack DRIFTED.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.