AWS AWSCloudFormation medium security documentation change
Summary
Added important note about PerformanceInsightsKMSKeyId update behavior and drift prevention
Security assessment
The change documents security-critical KMS key management behavior for encrypted performance insights. It explicitly addresses drift prevention (security misconfiguration) and update constraints for cryptographic keys, which directly impacts data protection.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.md index 024ec476c..9f64e6314 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.md @@ -1737,0 +1738,19 @@ If you do not specify a value for `PerformanceInsightsKMSKeyId`, then Amazon RDS +###### Important + +**Update behavior:** Once Performance Insights is enabled with a KMS key, you cannot change to a different physical KMS key without replacing the DB instance. However, the following updates do not require replacement: + + * Enabling or disabling Performance Insights using the `EnablePerformanceInsights` property + + * Changing between different identifier formats (key ARN, key ID, alias ARN, alias name) of the same physical KMS key + + * Removing the `PerformanceInsightsKMSKeyId` property from your template + + + + +###### Note + +**Drift behavior:** If you specify `PerformanceInsightsKMSKeyId` while `EnablePerformanceInsights` is set to `false`, CloudFormation will report drift. This occurs because the RDS API does not allow setting a KMS key when Performance Insights is disabled. CloudFormation ignores the `PerformanceInsightsKMSKeyId` value during instance creation to avoid API errors, resulting in a mismatch between your template and the actual instance configuration. + +To avoid drift, omit both `EnablePerformanceInsights` and `PerformanceInsightsKMSKeyId` during initial instance creation, then set both properties together when you're ready to enable Performance Insights. + @@ -1744 +1763 @@ _Required_ : No - _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + _Update requires_ : [Some interruptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-some-interrupt)