aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::EC2::Instance] - [BUG] - KmsKeyId false positive drift when specifying the key ID instead of ARN
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::Instance
### Resource Name
_No response_
### Issue Description
There is an issue with false positive drift for KMS Key ID.
BlockDeviceMappings.0.Ebs.KmsKeyId
Expected value: KMS ID
Current value: KMS ARN
Since the KmsKeyId property can be set to either the key ID or ARN, I use the Ref function to refer to the KMS key, and it populates the KmsKeyId with the ID and not the ARN.
CloudFormation thinks there is a drift because it sees the current value as the ARN and not the ID, hence the drift, even though its the same key.
### Expected Behavior
Either not count KmsKeyId in drift detection, or make CloudFormation refer both ARN and ID in the current value.
### Observed Behavior
BlockDeviceMappings.0.Ebs.KmsKeyId
NOT_EQUAL
58054ab4-9468-4299-b12f-xxxxxxx
arn:aws:kms:eu-west-1:xxxxxxxx:key/58054ab4-xxxxxx-4299-b12f-xxxxxxxx
### Test Cases
Create CloudFormation template with a KMS key resource and an EC2 resource and use a Ref function to reference the logical name of the KMS key in the KmsKeyId property of the EC2 resource.
### Other Details
_No response_
Contributor guide
Research direction
The issue names no repository files or tests. First reproduce the drift with a CloudFormation template containing KMS and EC2 resources, using Ref for BlockDeviceMappings.0.Ebs.KmsKeyId; done means the equivalent key ID and ARN no longer produce false-positive drift, or the accepted handling is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100