aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Add usage of Kms KeyAlias for KmsKeyId property under AWS::RDS::DBInstance resource

Open
#1,307 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::RDS::DBInstance

### Resource name

_No response_

### Description

The KmsKeyId property for the AWS::RDS::DBInstance resource is marked as drifted when just the Id (not full ARN) is specified in the template and the stack is created.

Ideally, drift detection should not have been performed on the KmsKeyId property as per - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html#drift-considerations

`CloudFormation does not perform drift detection on the KMSKeyId property of any resources. Because AWS KMS keys can be referenced by multiple aliases, CloudFormation can't guarantee consistently accurate drift results for this property.`

### Expected Behavior

The KmsKeyId property should be IN_SYNC or NOT_CHECKED status.

### Observed Behavior

The KmsKeyId property is marked as NOT_EQUAL with
expected = alias/xxxx-xxxx-xxxx-xxxx
actual = xxxx-xxxx-xxxx-xxxx

### Test Cases

Steps to reproduce -

1) Create Stack using following template -
```
Resources:
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName: MyFirstDB
Engine: MySQL
MasterUsername: master
MasterUserPassword: xxxxxxxx
DBInstanceClass: db.m5.large
StorageEncrypted: true
VPCSecurityGroups: sg-xxxxx
KmsKeyId: xxxx-xxxx-xxxx-xxxx
```
2) Run drift detection
3) View drift results

### Enhancement Request Ask -
Add feature which allows using Kms KeyAlias while specifying KmsKeyID in AWS::RDS::DBInstance resource.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue names no repository file, test, or implementation entry point. Start by reproducing the AWS::RDS::DBInstance template and running drift detection, then trace how KmsKeyId values are evaluated; done means the property is IN_SYNC or NOT_CHECKED rather than NOT_EQUAL when an ID is resolved through an alias.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, databases
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.