aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::EC2::Instance] - [BUG] - KmsKeyId false positive drift when specifying the key ID instead of ARN

Open
#2,233 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::Instance

### Resource Name

_No response_

### Issue Description

There is an issue with false positive drift for KMS Key ID.

BlockDeviceMappings.0.Ebs.KmsKeyId

Expected value: KMS ID
Current value: KMS ARN

Since the KmsKeyId property can be set to either the key ID or ARN, I use the Ref function to refer to the KMS key, and it populates the KmsKeyId with the ID and not the ARN.

CloudFormation thinks there is a drift because it sees the current value as the ARN and not the ID, hence the drift, even though its the same key.

### Expected Behavior

Either not count KmsKeyId in drift detection, or make CloudFormation refer both ARN and ID in the current value.

### Observed Behavior

BlockDeviceMappings.0.Ebs.KmsKeyId
NOT_EQUAL
58054ab4-9468-4299-b12f-xxxxxxx
arn:aws:kms:eu-west-1:xxxxxxxx:key/58054ab4-xxxxxx-4299-b12f-xxxxxxxx

### Test Cases

Create CloudFormation template with a KMS key resource and an EC2 resource and use a Ref function to reference the logical name of the KMS key in the KmsKeyId property of the EC2 resource.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files or tests. First reproduce the drift with a CloudFormation template containing KMS and EC2 resources, using Ref for BlockDeviceMappings.0.Ebs.KmsKeyId; done means the equivalent key ID and ARN no longer produce false-positive drift, or the accepted handling is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.