aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::ECR::Repository] - [BUG] - Import silently deletes RepositoryPolicyText; drift detection does not check it
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
**Name of the resource:** AWS::ECR::Repository
## Issue Description
CloudFormation importing an existing ECR repository **silently deletes** the repository's `RepositoryPolicyText` if the property is not declared in the template. There is no warning, no changeset diff showing a deletion, and no way to preview this side effect before executing the import. This is destructive and irreversible.
Additionally, drift detection does not evaluate `RepositoryPolicyText` when the property is not declared in the template. Policies added out-of-band (e.g., via CLI or by AWS services like Lambda) are never detected — the resource is always reported as `IN_SYNC`.
These two issues compound: the import silently destroys the policy, and drift detection would not have caught the mismatch even if the policy had survived.
This is particularly impactful because Lambda auto-creates a `LambdaECRImageRetrievalPolicy` on ECR repositories used for container image deployments. Importing such a repository without declaring that policy in the template deletes it with no warning, breaking Lambda's image pull access. Drift detection then reports `IN_SYNC`, giving no indication anything is wrong.
## Expected Behavior
1. Importing a resource should not delete properties that exist on the actual resource but are absent from the template — or at minimum, the changeset should surface this as a visible change before execution.
2. Drift detection should report `MODIFIED` when `RepositoryPolicyText` exists on the actual resource but is not declared in the template.
## Observed Behavior
1. The `IMPORT` changeset execution deletes `RepositoryPolicyText` from the actual repository if it is not in the template. The changeset preview gives no indication this will happen.
2. Drift detection reports `IN_SYNC` with zero property differences. `ActualProperties` does not even include `RepositoryPolicyText` — CloudFormation does not read the property from the actual resource when it is not declared in the template.
## Test Cases
1. **Import with existing policy (policy silently deleted):** Create an ECR repository outside of CloudFormation and attach a policy to it. Import the repository into a stack with no `RepositoryPolicyText` in the template. The import deletes the policy. See [reproduction steps in comments](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/2493#issuecomment-4227287944).
2. **Out-of-band policy addition (drift not detected):** Create a stack with an `AWS::ECR::Repository` that does not declare `RepositoryPolicyText`. Add a policy via `aws ecr set-repository-policy`. Run drift detection. Result: `IN_SYNC` with zero property differences.
## Other Details
Reproduced in us-east-1 on 2026-04-10.
Contributor guide
Research direction
No repository file or test entry point is identified in the issue. Start with the two listed reproduction cases: import an ECR repository with an existing policy, then add a policy out of band and run drift detection. Done means import no longer silently deletes RepositoryPolicyText, and drift detection reports the undeclared policy difference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100