aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::DynamoDB::Table] Drift detected when table is encrypted with KMS alias

Open
#1,802 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::DynamoDB::Table

### Resource Name

_No response_

### Issue Description

According to AWS CloudFormation documentation for DynamoDB table, we can use either KMS key ID or alias in the template when we want to encrypt the table with AWS KMS. The problem is that if you use KMS alias, CloudFormation detect a drift because it compares the KMS alias from the template with the KMS ID returned by the background call used by CloudFormation to get the table info.

### Expected Behavior

No drift detection if we use an KMS alias in the CloudFormation template.

### Observed Behavior

Drift detected if we use an KMS alias in the CloudFormation template.

### Test Cases

Create a DynamoDB table encrypted using KMS alias. Run a "detect drift" operation.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS CloudFormation documentation for AWS::DynamoDB::Table encryption and reproduce the reported case using a KMS alias. Run a drift detection operation and compare the template alias with the returned KMS value; done means the alias-based table no longer reports drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, databases
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.