Cloud Formation - Bucket drift detection reports false BucketEncryption drift

[MagnusNordboe]

Name of the resource

AWS::S3::Bucket

Resource Name

No response

Issue Description

Region: eu-west-1
Account ID: 903883324733
Affected resource: arn:aws:cloudformation:eu-west-1:903883324733:stack/amplify-passwordresetportal-migration-d8622/06a289e0-9d61-11f1-b7d6-06d037bfc73b, logical resource amplify-passwordresetportal-migration-d8622-deployment (AWS::S3::Bucket)

Description:

Running DetectStackResourceDrift/DetectStackDrift on the above stack reports drift on the BucketEncryption property:

Property: /BucketEncryption
  Deployed:  "null"
  Expected:  "{"ServerSideEncryptionConfiguration":[{"ServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}"

This appears to be a false positive. Querying the bucket directly confirms encryption is correctly configured and matches what's expected:

$ aws s3api get-bucket-encryption --bucket amplify-passwordresetportal-migration-d8622-deployment
{
    "ServerSideEncryptionConfiguration": {
        "Rules": [
            {
                "ApplyServerSideEncryptionByDefault": {
                    "SSEAlgorithm": "AES256"
                },
                "BucketKeyEnabled": false,
                "BlockedEncryptionTypes": {
                    "EncryptionType": ["SSE-C"]
                }
            }
        ]
    }
}

Expected Behavior

Running DriftDetection on this resource should provide no errors

Observed Behavior

False positive validation

Test Cases

Run amplify gen2-migration lock on an S3 bucket with default settings

Other Details

No response