Updating a tag on an EC2 KeyPair resource results in CloudFormation attempting to recreate the resource.

I created a KeyPair using CloudFormation. As per the documentation, the KeyName property is required, making this a custom named resource.

Howeve, the Tags property says that updates require no interruption, so I wouldn't expect the resource to be replaced in that case. The generated change set suggests that will be the case - notice that replacement = False, and details.requiresRecreation is never.

[
  {
    "resourceChange": {
      "logicalResourceId": "KeyPair",
      "action": "Modify",
      "physicalResourceId": "<resource>",
      "resourceType": "AWS::EC2::KeyPair",
      "replacement": "False",
      "moduleInfo": null,
      "details": [
        {
          "target": {
            "name": "Tags",
            "requiresRecreation": "Never",
            "attribute": "Properties"
          },
          "causingEntity": null,
          "evaluation": "Dynamic",
          "changeSource": "DirectModification"
        },
        {
          "target": {
            "name": "Tags",
            "requiresRecreation": "Never",
            "attribute": "Properties"
          },
          "causingEntity": "Version",
          "evaluation": "Static",
          "changeSource": "ParameterReference"
        }
      ],
      "changeSetId": null,
      "scope": [
        "Properties"
      ]
    },
    "hookInvocationCount": null,
    "type": "Resource"
  }
]

Yet when I make the change above, which is only updating one tag, and redeploy the CloudFormation template, the update fails.

CloudFormation cannot update a stack when a custom-named resource requires replacing. Rename <resource> and update the stack again.

I'm guessing there is a bug somewhere, but how can I avoid this, as this means that I can't update my CF template.

Thanks, David