aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::DynamoDB::GlobalTable] - Drift Detection false positive for KMSMasterKeyId property under AWS::DynamoDB::GlobalTable resource

Open
#2,232 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::DynamoDB::GlobalTable

### Resource Name

_No response_

### Issue Description

The "KMSMasterKeyId" property for the AWS::DynamoDB::GlobalTable resource is marked as drifted, even though there is no actual drift. The CloudFormation template is generated by the CDK using a higher-level construct to create the DynamoDB.

### Expected Behavior

The KMSMasterKeyId property should be IN_SYNC or NOT_CHECKED status.

### Observed Behavior

The KMSMasterKeyId property is marked as NOT_EQUAL with
expected = arn:aws:kms:eu-central-1:1234567891:key/xxxx-xxxx-xxxx-xxxx
actual = xxxx-xxxx-xxxx-xxxx

### Test Cases

Test Cases
Steps to reproduce -

1. Create Stack using following CDK code snippet:
```
this.dbTableScoring = new dynamoDB.TableV2(this, 'scoring_table', {
partitionKey: {
name: 'score_id',
type: dynamoDB.AttributeType.STRING
},
globalSecondaryIndexes: [
{
indexName: 'test_id_index',
partitionKey: {
name: 'test_id',
type: dynamoDB.AttributeType.STRING
},
projectionType: dynamoDB.ProjectionType.ALL
}
],
removalPolicy: databaseRetentionPolicy,
deletionProtection: props.enableDeletionProtection,
timeToLiveAttribute: 'expire_at',
encryption: dynamoDB.TableEncryptionV2.customerManagedKey(props.dynamoDbKmsKey),

});
}

```
2. Run drift detection
3. View drift results

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::DynamoDB::GlobalTable resource and the CDK TableV2 reproduction shown in the issue. Run the listed stack and drift-detection steps, then compare the expected KMSMasterKeyId ARN with the actual key ID; done means the property reports IN_SYNC or NOT_CHECKED when there is no real drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.