aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::ECR::RegistryScanningConfiguration] - [BUG] - Stack deletion tries to disable Inspector V2 which is an account ressource
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource Name
AWS::ECR::RegistryScanningConfiguration
### Issue Description
When a stack deploys an ECR RegistryScanningConfiguration, it also ensures that Inspector V2 is enabled on an account level which is fine (this means inspector2:Enable permission is required).
But on stack deletion, the resource cannot be deleted because it also wants to disable Inspector V2 on an account level (and thus asks for the inspector2:Disable permission).
This is a no go as Inspector V2 is a shared resource on the account level and it might be used by other resources.
### Expected Behavior
I would expect the resource to leave the Inspector V2 state as is.
### Observed Behavior
Currently, it tries to disable Inspector V2 on deletion (fortunately, I did not give it the permission to do so).
### Test Cases
Deploy an AWS::ECR::RegistryScanningConfiguration resource with continuous scans enabled.
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::ECR::RegistryScanningConfiguration behavior described in the issue and reproduce it by deploying the resource with continuous scans enabled. Verify that deleting the stack leaves the account-level Inspector V2 state unchanged and does not require inspector2:Disable permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100