Drift Detection for AWS::IAM::ManagedPolicy resource reported as IN_SYNC when there is drift

[satanupa]

trafficstars

Name of the resource

AWS::IAM::ManagedPolicy

Resource Name

No response

Issue Description

Drift detection on a stack with AWS::IAM::ManagedPolicy resource reports back as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.

Expected: { "Path": "/", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:CreateDBInstance", "rds:CreateDBClusterParameterGroup" ], "Resource": "arn:aws:rds:region:account-no:db:test*", "Effect": "Allow", "Sid": "Statement1" } ] }, "Description": "Policy for creating a test database" }

Actual: { "Path": "/", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:CreateDBInstance" ], "Resource": "arn:aws:rds:region:account-no:db:test*", "Effect": "Allow", "Sid": "Statement1" } ] }, "Description": "Policy for creating a test database" }

Expected Behavior

If there is a difference in the policy document json between actual resource and template specification, the resource should report as modified when performing drift detection.

Observed Behavior

Resource reports as "IN_SYNC" even when there is drift between the actual resource and template specification for the PolicyDocument property.

Test Cases

1. Create a Cloudformation stack to provision a ManagedPolicy resource. Resources:

Resources:
 CreateTestDBPolicy:
  Type: 'AWS::IAM::ManagedPolicy'
  Properties:
    Description: Policy for creating a test database
    Path: /
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Sid: 'Statement1'
          Effect: Allow
          Action: 
           - 'rds:CreateDBInstance'
           - 'rds:CreateDBClusterParameterGroup'
          Resource: !Join 
            - ''
            - - 'arn:aws:rds:'
              - !Ref 'AWS::Region'
              - ':'
              - !Ref 'AWS::AccountId'
              - ':db:test*'

2. Once the stack is created, Manually modify the managed policy physical resource - you can change any part(s) of the policy. eg: remove "'rds:CreateDBClusterParameterGroup'" from policy document.
3. Trigger drift detection on stack, the resource will report as "IN_SYNC" check the drift details and we can observe difference in Actual and Expected properties.

Other Details

No response