aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ECR::Repository] - [BUG] - EncryptionConfiguration.KmsKey drift from ARN to key ID

Open
#2,530 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ECR::Repository

### Resource Name

_No response_

### Issue Description

Creating an ECR repository with `EncryptionConfiguration.KmsKey` set to an ARN (via `Ref` to the `KMS::Key` resource) will result in a false-positive drift detection attempting to convert the ARN to the key ID.

### Expected Behavior

The ARN and the key ID would be equivalent and result in no drift.

### Observed Behavior

The ARN is marked as a drift, with the "Live State" showing the ARN and the "Proposed State" showing the ID.

### Test Cases

```yaml
AWSTemplateFormatVersion: "2010-09-09"
Resources:
KMSKey:
Type: "AWS::KMS::Key"
Properties:
Origin: "AWS_KMS"
KeyUsage: "ENCRYPT_DECRYPT"
KeySpec: "SYMMETRIC_DEFAULT"
MultiRegion: false

ECRRepo:
Type: "AWS::ECR::Repository"
Properties:
RepositoryName: "some-repo"
EncryptionConfiguration:
EncryptionType: "KMS"
KmsKey:
Ref: "KMSKey"
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the YAML test case in the issue and reproduce drift detection for AWS::ECR::Repository with EncryptionConfiguration.KmsKey set through a KMS::Key Ref. Done means the ARN and key ID are treated as equivalent, so the repository reports no false-positive drift.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.