[Varshith-Kali]

Fixes #4839.

What

E3720 required StorageEncrypted on every AWS::RDS::DBInstance with KmsKeyId and a non-custom engine, because the kmskey_storageencrypted.json extension schema never looked at SourceDBInstanceIdentifier. That flagged a cross-region read replica written exactly the way the DBInstance reference describes: a KMS key for the destination region and no StorageEncrypted, which is inherited from the source instance (the reference explicitly says not to specify the property when SourceDBInstanceIdentifier or SourceDbiResourceId is set).

The if-clause now skips resources that set SourceDBInstanceIdentifier or SourceDbiResourceId, so those replicas no longer raise E3720. Ordinary instances keep the existing behavior, including the custom-engine exemption and the truthy-value check.

Verification

Reproduced end to end with cfn-lint on a template containing both a cross-region read replica and a normal instance with KmsKeyId: before the fix, both raised E3720; after the fix, only the normal instance does.

Added 3 regression cases to test_db_instance_kmskey_storage_encrypted.py (SourceDBInstanceIdentifier without StorageEncrypted, SourceDbiResourceId without StorageEncrypted, and a replica that also sets StorageEncrypted). Full lmbd and rds unit suites pass (351 tests), ruff check and format clean.

[Varshith-Kali]

Hi @kddejong, thanks for clearing the workflow approval. CI ran, but unitlint (ubuntu-latest, 3.14) failed on test/integration/test_integration_templates.py::TestQuickStartTemplates::test_templates for aws-ec2-networkinterface.yaml: the run reports a duplicate E3020 finding (Ipv6AddressCount/Ipv6Addresses exclusion) beyond the fixture expectations. This PR only touches the RDS E3720 extension schema and its unit tests, so the EC2 finding looks unrelated to this change. I do not have rights to re-run the job; could you re-run the failed job when convenient?

[Varshith-Kali]

kddejong, a heads-up on the unitlint failure: it is not from this PR's change. I reproduced the same test_templates failure on the base commit (2a10fb4) without this PR's commit applied. The cause looks like drift in the enhanced schemas: the AWS::EC2::NetworkInterface schema now expresses the Ipv6Addresses/Ipv6AddressCount exclusion with not/required instead of dependentExcluded, so the run reports E3002 where the fixture expects E3020. The schema bundle was regenerated after the last green main run. Happy to regenerate the fixture expectation here, or leave it for a main-side fix and re-run after, whichever you prefer.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.68%. Comparing base (5e2c835) to head (cdf009f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4842   +/-   ##
=======================================
  Coverage   94.68%   94.68%           
=======================================
  Files         439      439           
  Lines       16004    16004           
  Branches     3108     3108           
=======================================
  Hits        15153    15153           
  Misses        468      468           
  Partials      383      383           

Flag	Coverage Δ
unittests	94.67% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.