aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::ECR::Repository] - [BUG] - EncryptionConfiguration.KmsKey drift from ARN to key ID
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::ECR::Repository
### Resource Name
_No response_
### Issue Description
Creating an ECR repository with `EncryptionConfiguration.KmsKey` set to an ARN (via `Ref` to the `KMS::Key` resource) will result in a false-positive drift detection attempting to convert the ARN to the key ID.
### Expected Behavior
The ARN and the key ID would be equivalent and result in no drift.
### Observed Behavior
The ARN is marked as a drift, with the "Live State" showing the ARN and the "Proposed State" showing the ID.
### Test Cases
```yaml
AWSTemplateFormatVersion: "2010-09-09"
Resources:
KMSKey:
Type: "AWS::KMS::Key"
Properties:
Origin: "AWS_KMS"
KeyUsage: "ENCRYPT_DECRYPT"
KeySpec: "SYMMETRIC_DEFAULT"
MultiRegion: false
ECRRepo:
Type: "AWS::ECR::Repository"
Properties:
RepositoryName: "some-repo"
EncryptionConfiguration:
EncryptionType: "KMS"
KmsKey:
Ref: "KMSKey"
```
### Other Details
_No response_
Contributor guide
Research direction
Start with the YAML test case in the issue and reproduce drift detection for AWS::ECR::Repository with EncryptionConfiguration.KmsKey set through a KMS::Key Ref. Done means the ARN and key ID are treated as equivalent, so the repository reports no false-positive drift.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100