aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ECR::RegistryScanningConfiguration] - [BUG] - Stack deletion tries to disable Inspector V2 which is an account ressource

Open
#2,516 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource Name

AWS::ECR::RegistryScanningConfiguration

### Issue Description

When a stack deploys an ECR RegistryScanningConfiguration, it also ensures that Inspector V2 is enabled on an account level which is fine (this means inspector2:Enable permission is required).

But on stack deletion, the resource cannot be deleted because it also wants to disable Inspector V2 on an account level (and thus asks for the inspector2:Disable permission).

This is a no go as Inspector V2 is a shared resource on the account level and it might be used by other resources.

### Expected Behavior

I would expect the resource to leave the Inspector V2 state as is.

### Observed Behavior

Currently, it tries to disable Inspector V2 on deletion (fortunately, I did not give it the permission to do so).

### Test Cases

Deploy an AWS::ECR::RegistryScanningConfiguration resource with continuous scans enabled.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::ECR::RegistryScanningConfiguration behavior described in the issue and reproduce it by deploying the resource with continuous scans enabled. Verify that deleting the stack leaves the account-level Inspector V2 state unchanged and does not require inspector2:Disable permission.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.