aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::DynamoDB::Table] Drift detected when table is encrypted with KMS alias
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::DynamoDB::Table
### Resource Name
_No response_
### Issue Description
According to AWS CloudFormation documentation for DynamoDB table, we can use either KMS key ID or alias in the template when we want to encrypt the table with AWS KMS. The problem is that if you use KMS alias, CloudFormation detect a drift because it compares the KMS alias from the template with the KMS ID returned by the background call used by CloudFormation to get the table info.
### Expected Behavior
No drift detection if we use an KMS alias in the CloudFormation template.
### Observed Behavior
Drift detected if we use an KMS alias in the CloudFormation template.
### Test Cases
Create a DynamoDB table encrypted using KMS alias. Run a "detect drift" operation.
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS CloudFormation documentation for AWS::DynamoDB::Table encryption and reproduce the reported case using a KMS alias. Run a drift detection operation and compare the template alias with the returned KMS value; done means the alias-based table no longer reports drift.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100