Open rgoltz opened 9 months ago
An additional (strange) aspect - This only applies if you using Stack-Level-Tags:
Here is an example as a follow-up of the example above:
So, if you have a drift [NOT_EQUAL] on an other property of AWS::SSM::Parameter
, like Value
(in template defined "-", but it's changed to "1" outside of CFN) and you combined this with Stack-Level-Tags (here: TagOnStackLevel): You can see "Expected" those Stack-Level-Tags. The Tags added within the Template are not shown at all (here: Environment).
Name of the resource
AWS::SSM::Parameter
Resource Name
No response
Issue Description
The resource
AWS::SSM::Parameter
is listed as support for CloudFormation Drift Detection. Drift Detection is a great feature to detect out-of-bound changes (e.g. via Console in case of an hotfix, etc.).Expected Behavior
Drift Detection is able to report and display changes of
Tags
forAWS::SSM::Parameter
. Within the Drift Detection Details, we expect Tags under "Expected" and "Actual" as part of the "View drift results".Observed Behavior
Drift Detection is not checking
Tags
forAWS::SSM::Parameter
and Drift Detection does not report changed or added tags via out of the CFN stack.Test Cases
step 1:
Create a stack using following example template:
step 2:
Once the stack is successfully created, please: Check the newly created SSM Parameter for the defined tags. Tags has been added as expected. + Run the Drift Detection. The the result - Stack is in state IN_SYNC.
step 3:
Change the tag and/or Add a new tag to the SSM Parameter via Console: (In this example the value for Tag "Environment" changed from DEV to PRD. Futhermore there is new Tag TestTagViaConsole added.)
step 4:
Run the Drift Detection again. Drift Detection is not able to report the out-of-bound change. Stack is still reported as IN_SYNC 🤨 - This is not correct.
Other Details
Furthermore, there is a general bad UX behavior in the AWS Console. The Tags
aws:cloudformation:stack-name
,aws:cloudformation:logical-id
andaws:cloudformation:stack-id
are (useful) CloudFormation built-in tags / default service-managed auto-tags. The Console reporting them as "Cannot start with aws:" (see above). Once you click on "Save tags" in Console, the Tags are saved, but there is no "saved successfully" in Console. It happens nothing. That's bad as well.This happens for all SSM Parameter resources deployed as CloudFormation Stack 😟