I have a CloudFormation stack that provisions a CloudFront distribution.
Whenever a resource is provisioned under a CloudFormation stack, CloudFormation attempts to tag that resource with any tags on the stack (according to the documentation of the --tags parameter on the create-stack command page).
Just the same, my CloudFormation stack attempts, and is successful in tagging the CloudFront distribution. However, when I run drift detection on the stack immediately after the distribution is created, CloudFormation detects drift on the distribution.
As you can see here, CloudFormation doesn't even recognize the existence of any tags on the distribution, signified by the REMOVE difference. However, the tag is clearly and demonstrably applied to the distribution.
I even added an extra tag to see if it gets picked up by drift detection, but it does not.
I can inline it if necessary, but the template for the stack in question is in my other question here.
Why is drift detection erroneously excluding these tags?
This probably will not have any impact on my stack as a whole or my ability to use and update these resources, but having a bad drift report kills my OCD.