aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Drift detection can't detect inline policies added to an IAM Role.
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::Role
### Resource Name
AWS::IAM::Role
### Issue Description
If an inline policy is added to an IAM role, drift detection should pick that up as drift (because the permissions of the role have materially changed).
### Expected Behavior
Drift detection should mark the resource as 'MODIFIED' and thus the stack as 'DRIFTED'.
### Observed Behavior
Drift detection marks the resource and stack as 'IN_SYNC'.
### Test Cases
1. Deploy a stack with the following template:
```
Resources:
testRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
```
1. Manually add an inline policy to the role in the IAM console
1. Run drift detect
1. Note that drift detection doesn't pick up the added policy
### Other Details
_No response_
Contributor guide
Research direction
The issue names AWS::IAM::Role but provides no repository files or tests. Reproduce the listed case by deploying the template, adding an inline policy in IAM, and running drift detection; done means the role is marked MODIFIED and the stack DRIFTED.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100