feat: add drift detection to cdk as cdk drift

.projenrc.ts

@@ -431,6 +431,7 @@ const cloudFormationDiff = configureProject(
     deps: [
       '@aws-cdk/aws-service-spec',
       '@aws-cdk/service-spec-types',
+      '@aws-sdk/client-cloudformation',
       'chalk@^4',
       'diff',
       'fast-deep-equal',

packages/@aws-cdk-testing/cli-integ/resources/cdk-apps/app/app.js

@@ -475,6 +475,33 @@ class LambdaStack extends cdk.Stack {
   }
 }
 
+class DriftableLambdaStack extends cdk.Stack {
+  constructor(parent, id, props) {
+    const synthesizer = parent.node.tryGetContext('legacySynth') === 'true' ?
+      new LegacyStackSynthesizer({
+        fileAssetsBucketName: parent.node.tryGetContext('bootstrapBucket'),
+      })
+      : new DefaultStackSynthesizer({
+        fileAssetsBucketName: parent.node.tryGetContext('bootstrapBucket'),
+      })
+    super(parent, id, {
+      ...props,
+      synthesizer: synthesizer,
+    });
+
+    const fn = new lambda.Function(this, 'my-function', {
+      code: lambda.Code.asset(path.join(__dirname, 'lambda')),
+      runtime: lambda.Runtime.NODEJS_LATEST,
+      handler: 'index.handler',
+      description: 'This is my function!',
+      timeout: cdk.Duration.seconds(5),
+      memorySize: 128
+    });
+
+    new cdk.CfnOutput(this, 'FunctionArn', { value: fn.functionArn });
+  }
+}
+
 class IamRolesStack extends cdk.Stack {
   constructor(parent, id, props) {
     super(parent, id, props);
@@ -942,6 +969,8 @@ switch (stackSet) {
     new BundlingStage(app, `${stackPrefix}-bundling-stage`);
 
     new MetadataStack(app, `${stackPrefix}-metadata`);
+
+    new DriftableLambdaStack(app, `${stackPrefix}-driftable-lambda`);
     break;
 
   case 'stage-using-context':

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cdk-cdk-drift---fail-throws-when-drift-is-detected.integtest.ts

@@ -0,0 +1,77 @@
+import { DescribeStackResourcesCommand } from '@aws-sdk/client-cloudformation';
+import { GetFunctionCommand, UpdateFunctionConfigurationCommand } from '@aws-sdk/client-lambda';
+import { integTest, sleep, withDefaultFixture } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest(
+  'cdk drift --fail throws when drift is detected',
+  withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('driftable-lambda', {});
+
+    // Assert that, right after deploying, there is no drift (because we just deployed it)
+    const drift = await fixture.cdk(['drift', '--fail', fixture.fullStackName('driftable-lambda')], { verbose: false });
+
+    expect(drift).toContain('No drift detected');
+
+    // Get the Lambda, we want to now make it drift
+    const response = await fixture.aws.cloudFormation.send(
+      new DescribeStackResourcesCommand({
+        StackName: fixture.fullStackName('driftable-lambda'),
+      }),
+    );
+    const lambdaResource = response.StackResources?.find(
+      resource => resource.ResourceType === 'AWS::Lambda::Function',
+    );
+    if (!lambdaResource || !lambdaResource.PhysicalResourceId) {
+      throw new Error('Could not find Lambda function in stack resources');
+    }
+    const functionName = lambdaResource.PhysicalResourceId;
+
+    // Update the Lambda function, introducing drift
+    await fixture.aws.lambda.send(
+      new UpdateFunctionConfigurationCommand({
+        FunctionName: functionName,
+        Description: 'I\'m slowly drifting (drifting away)',
+      }),
+    );
+
+    // Wait for the stack update to complete
+    await waitForLambdaUpdateComplete(fixture, functionName);
+
+    await expect(
+      fixture.cdk(['drift', '--fail', fixture.fullStackName('driftable-lambda')], { verbose: false }),
+    ).rejects.toThrow('exited with error');
+  }),
+);
+
+async function waitForLambdaUpdateComplete(fixture: any, functionName: string): Promise<void> {
+  const delaySeconds = 5;
+  const timeout = 30_000; // timeout after 30s
+  const deadline = Date.now() + timeout;
+
+  while (true) {
+    const response = await fixture.aws.lambda.send(
+      new GetFunctionCommand({
+        FunctionName: functionName,
+      }),
+    );
+
+    const lastUpdateStatus = response.Configuration?.LastUpdateStatus;
+
+    if (lastUpdateStatus === 'Successful') {
+      return; // Update completed successfully
+    }
+
+    if (lastUpdateStatus === 'Failed') {
+      throw new Error('Lambda function update failed');
+    }
+
+    if (Date.now() > deadline) {
+      throw new Error(`Timed out after ${timeout / 1000} seconds.`);
+    }
+
+    // Wait before checking again
+    await sleep(delaySeconds * 1000);
+  }
+}

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cdk-cdk-drift---quiet-outputs-when-failing-else-nothing.integtest.ts

@@ -0,0 +1,80 @@
+import { DescribeStackResourcesCommand } from '@aws-sdk/client-cloudformation';
+import { GetFunctionCommand, UpdateFunctionConfigurationCommand } from '@aws-sdk/client-lambda';
+import { integTest, sleep, withDefaultFixture } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest(
+  'cdk drift --quiet outputs when failing else nothing',
+  withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('driftable-lambda', {});
+
+    // Assert that, right after deploying, there is no drift (because we just deployed it)
+    const drift = await fixture.cdk(['drift', '--quiet', fixture.fullStackName('driftable-lambda')], { verbose: false });
+
+    expect(drift).not.toMatch(/Stack.*driftable-lambda/); // cant just .toContain because of formatting
+    expect(drift).not.toContain('No drift detected');
+
+    // Get the Lambda, we want to now make it drift
+    const response = await fixture.aws.cloudFormation.send(
+      new DescribeStackResourcesCommand({
+        StackName: fixture.fullStackName('driftable-lambda'),
+      }),
+    );
+    const lambdaResource = response.StackResources?.find(
+      resource => resource.ResourceType === 'AWS::Lambda::Function',
+    );
+    if (!lambdaResource || !lambdaResource.PhysicalResourceId) {
+      throw new Error('Could not find Lambda function in stack resources');
+    }
+    const functionName = lambdaResource.PhysicalResourceId;
+
+    // Update the Lambda function, introducing drift
+    await fixture.aws.lambda.send(
+      new UpdateFunctionConfigurationCommand({
+        FunctionName: functionName,
+        Description: 'I\'m slowly drifting (drifting away)',
+      }),
+    );
+
+    // Wait for the stack update to complete
+    await waitForLambdaUpdateComplete(fixture, functionName);
+
+    const driftAfterModification = await fixture.cdk(['drift', '--quiet', fixture.fullStackName('driftable-lambda')], { verbose: false });
+
+    // Even with --quiet, we should still see an output
+    expect(driftAfterModification).toMatch(/Stack.*driftable-lambda/);
+    expect(driftAfterModification).toContain('1 resource has drifted');
+  }),
+);
+
+async function waitForLambdaUpdateComplete(fixture: any, functionName: string): Promise<void> {
+  const delaySeconds = 5;
+  const timeout = 30_000; // timeout after 30s
+  const deadline = Date.now() + timeout;
+
+  while (true) {
+    const response = await fixture.aws.lambda.send(
+      new GetFunctionCommand({
+        FunctionName: functionName,
+      }),
+    );
+
+    const lastUpdateStatus = response.Configuration?.LastUpdateStatus;
+
+    if (lastUpdateStatus === 'Successful') {
+      return; // Update completed successfully
+    }
+
+    if (lastUpdateStatus === 'Failed') {
+      throw new Error('Lambda function update failed');
+    }
+
+    if (Date.now() > deadline) {
+      throw new Error(`Timed out after ${timeout / 1000} seconds.`);
+    }
+
+    // Wait before checking again
+    await sleep(delaySeconds * 1000);
+  }
+}

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cdk-cdk-drift---verbose-shows-unchecked-resources.integtest.ts

@@ -0,0 +1,19 @@
+import { integTest, withDefaultFixture } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest(
+  'cdk drift --verbose shows unchecked resources',
+  withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('define-vpc', { modEnv: { ENABLE_VPC_TESTING: 'DEFINE' } });
+
+    // Assert that there's no drift when we deploy it, but there should be
+    // unchecked resources, as there are some EC2 connection resources
+    // (e.g. SubnetRouteTableAssociation) that do not support drift detection
+    const drift = await fixture.cdk(['drift', '--verbose', fixture.fullStackName('define-vpc')], { modEnv: { ENABLE_VPC_TESTING: 'DEFINE' } });
+
+    expect(drift).toMatch(/Stack.*define-vpc/); // cant just .toContain because of formatting
+    expect(drift).toContain('No drift detected');
+    expect(drift).toContain('(3 unchecked)'); // 2 SubnetRouteTableAssociations, 1 VPCGatewayAttachment
+  }),
+);

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cdk-cdk-drift.integtest.ts

@@ -0,0 +1,96 @@
+import { DescribeStackResourcesCommand } from '@aws-sdk/client-cloudformation';
+import { GetFunctionCommand, UpdateFunctionConfigurationCommand } from '@aws-sdk/client-lambda';
+import { integTest, sleep, withDefaultFixture } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest(
+  'cdk drift',
+  withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('driftable-lambda', {});
+
+    // Assert that, right after deploying, there is no drift (because we just deployed it)
+    const drift = await fixture.cdk(['drift', fixture.fullStackName('driftable-lambda')], { verbose: false });
+
+    expect(drift).toMatch(/Stack.*driftable-lambda/); // can't just .toContain because of formatting
+    expect(drift).toContain('No drift detected');
+    expect(drift).toContain('✨  Number of resources with drift: 0');
+    expect(drift).not.toContain('unchecked'); // should not see unchecked resources unless verbose
+
+    // Get the Lambda, we want to now make it drift
+    const response = await fixture.aws.cloudFormation.send(
+      new DescribeStackResourcesCommand({
+        StackName: fixture.fullStackName('driftable-lambda'),
+      }),
+    );
+    const lambdaResource = response.StackResources?.find(
+      resource => resource.ResourceType === 'AWS::Lambda::Function',
+    );
+    if (!lambdaResource || !lambdaResource.PhysicalResourceId) {
+      throw new Error('Could not find Lambda function in stack resources');
+    }
+    const functionName = lambdaResource.PhysicalResourceId;
+
+    // Update the Lambda function, introducing drift
+    await fixture.aws.lambda.send(
+      new UpdateFunctionConfigurationCommand({
+        FunctionName: functionName,
+        Description: 'I\'m slowly drifting (drifting away)',
+      }),
+    );
+
+    // Wait for the stack update to complete
+    await waitForLambdaUpdateComplete(fixture, functionName);
+
+    const driftAfterModification = await fixture.cdk(['drift', fixture.fullStackName('driftable-lambda')], { verbose: false });
+
+    const expectedMatches = [
+      /Stack.*driftable-lambda/,
+      /[-].*This is my function!/m,
+      /[+].*I'm slowly drifting \(drifting away\)/m,
+    ];
+    const expectedSubstrings = [
+      '1 resource has drifted', // num resources drifted
+      '✨  Number of resources with drift: 1',
+      'AWS::Lambda::Function', // the lambda should be marked drifted
+      '/Description', // the resources that have drifted
+    ];
+    for (const expectedMatch of expectedMatches) {
+      expect(driftAfterModification).toMatch(expectedMatch);
+    }
+    for (const expectedSubstring of expectedSubstrings) {
+      expect(driftAfterModification).toContain(expectedSubstring);
+    }
+  }),
+);
+
+async function waitForLambdaUpdateComplete(fixture: any, functionName: string): Promise<void> {
+  const delaySeconds = 5;
+  const timeout = 30_000; // timeout after 30s
+  const deadline = Date.now() + timeout;
+
+  while (true) {
+    const response = await fixture.aws.lambda.send(
+      new GetFunctionCommand({
+        FunctionName: functionName,
+      }),
+    );
+
+    const lastUpdateStatus = response.Configuration?.LastUpdateStatus;
+
+    if (lastUpdateStatus === 'Successful') {
+      return; // Update completed successfully
+    }
+
+    if (lastUpdateStatus === 'Failed') {
+      throw new Error('Lambda function update failed');
+    }
+
+    if (Date.now() > deadline) {
+      throw new Error(`Timed out after ${timeout / 1000} seconds.`);
+    }
+
+    // Wait before checking again
+    await sleep(delaySeconds * 1000);
+  }
+}