aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Add usage of Kms KeyAlias for KmsKeyId property under AWS::RDS::DBInstance resource
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::RDS::DBInstance
### Resource name
_No response_
### Description
The KmsKeyId property for the AWS::RDS::DBInstance resource is marked as drifted when just the Id (not full ARN) is specified in the template and the stack is created.
Ideally, drift detection should not have been performed on the KmsKeyId property as per - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html#drift-considerations
`CloudFormation does not perform drift detection on the KMSKeyId property of any resources. Because AWS KMS keys can be referenced by multiple aliases, CloudFormation can't guarantee consistently accurate drift results for this property.`
### Expected Behavior
The KmsKeyId property should be IN_SYNC or NOT_CHECKED status.
### Observed Behavior
The KmsKeyId property is marked as NOT_EQUAL with
expected = alias/xxxx-xxxx-xxxx-xxxx
actual = xxxx-xxxx-xxxx-xxxx
### Test Cases
Steps to reproduce -
1) Create Stack using following template -
```
Resources:
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName: MyFirstDB
Engine: MySQL
MasterUsername: master
MasterUserPassword: xxxxxxxx
DBInstanceClass: db.m5.large
StorageEncrypted: true
VPCSecurityGroups: sg-xxxxx
KmsKeyId: xxxx-xxxx-xxxx-xxxx
```
2) Run drift detection
3) View drift results
### Enhancement Request Ask -
Add feature which allows using Kms KeyAlias while specifying KmsKeyID in AWS::RDS::DBInstance resource.
### Other Details
_No response_
Contributor guide
Research direction
The issue names no repository file, test, or implementation entry point. Start by reproducing the AWS::RDS::DBInstance template and running drift detection, then trace how KmsKeyId values are evaluated; done means the property is IN_SYNC or NOT_CHECKED rather than NOT_EQUAL when an ID is resolved through an alias.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100