Can CloudFormation detect drift of a AWS::AppSync::ApiKey?

Question

I have a stack with a `AWS::AppSync::GraphQLApi` resource that has an `AuthenticationType` set to `API_KEY`. In the same stack template I have a `AWS::AppSync::ApiKey` resource that is linked to the `GraphQLApi` resource via the `ApiId` property. This has been deployed into an account, but subsequently the ApiKey resource has been deleted via the AppSync console.

When I run drift detection on the stack neither of the `GraphQLApi` or `ApiKey` resources are listed (whereas a `AWS::AppSync::Resolver` is listed).

If I add another resource to the template and attempt to deploy it, CloudFormation halts deployment with an "API key not found" error.

Does this mean that CloudFormation cannot detect drift for either `GraphQLApi` or `ApiKey` resource types?

Nihar · Accepted Answer

Hello Iain Woolley,

I replicated your scenario by deploying a CloudFormation stack with `AWS::AppSync::GraphQLApi` and `AWS::AppSync::ApiKey` resources. After manually deleting the API key via the AppSync console, I ran drift detection on the stack. No drift was reported for either resource. Additionally, attempting to add a new resource to the stack failed with the error:

> API key not found: da2-ev7e42k2cregppsk#### (Service: AWSAppSync; Status Code: 404; Error Code: NotFoundException; Request ID: 387ad459-379f-495b-9d8f-####; Proxy: null)

This behavior is expected. Per the [AWS CloudFormation Resource type support](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html) documentation, `AWS::AppSync::ApiKey` does not support drift detection.

**Recommendations:**

1. Manage Resources Exclusively via CloudFormation: To prevent drift and ensure consistency, we recommend managing all AppSync resources (including API keys) solely through CloudFormation. Avoid manual changes via the AWS Console, CLI, or SDK.

2. Recover from Drift:
To resolve the current issue, you can either:
Recreate the deleted API key in the AppSync console with the same ApiId to align with the template.
Or, remove the AWS::AppSync::ApiKey resource from the template and update the stack, then re-add it if needed.
After aligning the resources, retry the stack update.

3. Check Documentation for Updates: AWS periodically adds drift detection support for new resource types. Refer to the AWS CloudFormation documentation for the latest list of supported resources: [AWS CloudFormation Resource type support](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html)

I hope this is helpful.

---

*Please upvote this answer if you find it helpful. Thank you!*

SHAJAM · Answer

As mentioned by Nihar, CloudFormation does not detect drift for all resources. To avoid similar problems in the future, 
* Store the api key in SSM parameter and obtain the value from there when needed. 
* Write a custom AWS config rule to check if the value has changed. It's a bit of work as you need custom lambda function.
* Use third-party tools like driftctl [https://github.com/snyk/driftctl]
* Finally, avoid deletion of the resource unless it is called via CloudFormation. This can be achieved via SCP or IAM policy as shown below.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDirectApiKeyDelete",
      "Effect": "Deny",
      "Action": [
        "appsync:DeleteApiKey",
        "appsync:UpdateApiKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:CalledVia": "cloudformation.amazonaws.com"
        }
      }
    }
  ]
}

```

Can CloudFormation detect drift of a AWS::AppSync::ApiKey?

Add your answer

Relevant content