aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::DynamoDB::GlobalTable] - Drift Detection false positive for KMSMasterKeyId property under AWS::DynamoDB::GlobalTable resource
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::DynamoDB::GlobalTable
### Resource Name
_No response_
### Issue Description
The "KMSMasterKeyId" property for the AWS::DynamoDB::GlobalTable resource is marked as drifted, even though there is no actual drift. The CloudFormation template is generated by the CDK using a higher-level construct to create the DynamoDB.
### Expected Behavior
The KMSMasterKeyId property should be IN_SYNC or NOT_CHECKED status.
### Observed Behavior
The KMSMasterKeyId property is marked as NOT_EQUAL with
expected = arn:aws:kms:eu-central-1:1234567891:key/xxxx-xxxx-xxxx-xxxx
actual = xxxx-xxxx-xxxx-xxxx
### Test Cases
Test Cases
Steps to reproduce -
1. Create Stack using following CDK code snippet:
```
this.dbTableScoring = new dynamoDB.TableV2(this, 'scoring_table', {
partitionKey: {
name: 'score_id',
type: dynamoDB.AttributeType.STRING
},
globalSecondaryIndexes: [
{
indexName: 'test_id_index',
partitionKey: {
name: 'test_id',
type: dynamoDB.AttributeType.STRING
},
projectionType: dynamoDB.ProjectionType.ALL
}
],
removalPolicy: databaseRetentionPolicy,
deletionProtection: props.enableDeletionProtection,
timeToLiveAttribute: 'expire_at',
encryption: dynamoDB.TableEncryptionV2.customerManagedKey(props.dynamoDbKmsKey),
});
}
```
2. Run drift detection
3. View drift results
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::DynamoDB::GlobalTable resource and the CDK TableV2 reproduction shown in the issue. Run the listed stack and drift-detection steps, then compare the expected KMSMasterKeyId ARN with the actual key ID; done means the property reports IN_SYNC or NOT_CHECKED when there is no real drift.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100