search

aws-cloudformation / cloudformation-coverage-roadmap

The AWS CloudFormation Public Coverage Roadmap
https://aws.amazon.com/cloudformation/
Creative Commons Attribution Share Alike 4.0 International
1.1k stars 53 forks source link

cannot change EKS cluster encryption config without replacement #1931

Open rittneje opened 4 months ago

rittneje commented 4 months ago

Name of the resource

AWS::EKS::Cluster

Resource Name

No response

Issue Description

Reopening #1234. The response that you "do not have a plan to support updating encryption config" is not acceptable.

EKS supports enabling (but not disabling) secret encryption on an existing cluster. https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html

However, attempting to enable encryption via CloudFormation will force a replacement for no reason. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-cluster.html#cfn-eks-cluster-encryptionconfig

Expected Behavior

Enabling encryption on an existing cluster via CloudFormation must be allowed.

Observed Behavior

CloudFormation forces a cluster replacement for no reason.

Test Cases

Create an EKS cluster with encryption disabled. Then update the stack to enable it.

Other Details

No response