cloudposse / cloudposse/terraform-aws-ssm-patch-manager

Install maintenance window task incorrectly uses scan logs S3 prefix instead of install logs prefix

Open
#72 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
HCL
Stars
31
Forks
19
PR merge metrics
No merged PRs in 30d

Description

### Describe the Bug

# Description
There is a bug in the [main.tf](vscode-file://vscode-app/c:/Users/rpanda/AppData/Local/Programs/Microsoft%20VS%20Code/resources/app/out/vs/code/electron-browser/workbench/workbench.html) file where the install maintenance window task (aws_ssm_maintenance_window_task.task_install_patches) is using the incorrect S3 key prefix for output logs. Both scan and install operations are currently writing their logs to the same S3 prefix ("scanning"), instead of having separate prefixes for scan ("scanning") and install ("install") operations.

# Impact

- Functionality: Install operation logs are incorrectly stored in the "scanning" S3 folder instead of the "install" folder
- Log Management: Makes it impossible to distinguish between scan and install operation logs when reviewing S3 bucket contents
- Compliance/Auditing: Complicates log analysis and reporting as both operation types are mixed together
- User Experience: Confusing for users who expect separate log organization based on operation type

# Affected File and Location
File: main.tf
Line #146 ( https://github.com/cloudposse/terraform-aws-ssm-patch-manager/blob/main/main.tf#L146 ) in the aws_ssm_maintenance_window_task.task_install_patches resource.

Resource: aws_ssm_maintenance_window_task.task_install_patches

### Expected Behavior

Scan operations should write logs to: s3://bucket-name/scanning/...
Install operations should write logs to: s3://bucket-name/install/...

### Steps to Reproduce

- Deploy the module with S3 logging enabled
- Execute both scan and install patch operations
- Check the S3 bucket contents
- Observe that both operations write logs to the "scanning/" prefix instead of separate "scanning/" and "install/" - prefixes

### Screenshots

_No response_

### Environment

_No response_

### Additional Context

# Root Cause Analysis
The bug appears to be a copy-paste error where the install maintenance window task configuration was copied from the scan maintenance window task configuration, but the S3 key prefix variable reference was not updated appropriately.

# Variables Reference
The module correctly defines both variables:

var.s3_bucket_prefix_scan_logs (default: "scanning") - Used correctly in scan task
var.s3_bucket_prefix_install_logs (default: "install") - Should be used in install task but currently is not

# Fix required:

the code needs to be fixed at line #146 to reference the correct variable.
## Current code:
`output_s3_key_prefix = var.s3_log_output_enabled ? var.s3_bucket_prefix_scan_logs : null`

## Fixed Code :

`output_s3_key_prefix = var.s3_log_output_enabled ? var.s3_bucket_prefix_install_logs : null`

Contributor guide

Open the contributing guide

Research direction

Open main.tf around line 146 and inspect the aws_ssm_maintenance_window_task.task_install_patches resource alongside the scan task. Verify that the install task uses var.s3_bucket_prefix_install_logs while scanning continues to use var.s3_bucket_prefix_scan_logs, then confirm the resulting prefixes match the expected S3 layout.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.