(backup): BackupVault no longer compatible with kms.CfnReplicaKey
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
CDK 2.215.0 introduced new shared interfaces between L1 and L2 resources. Unfortunately the `backup.BackupVault` construct is not yet fully compatible with these interface.
Related code: https://github.com/aws/aws-cdk/pull/35032/files#diff-a31b96329c8b9697f18b560fd50662f96c62739f4513ada812cb6b17f39ecfb8
### Regression Issue
- [x] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
2.214.0
### Expected Behavior
`backup.BackupVault` should be compatible with `kms.Key`, `kms.CfnKey` and `kms.CfnReplicaKey`.
### Current Behavior
`backup.BackupVault` is not compatible with `kms.CfnReplicaKey`.
### Reproduction Steps
```python
cfn_replica_key = kms.CfnReplicaKey(self, …)
vault = backup.BackupVault(self, "BackupVault",
encryption_key = cfn_replica_key
)
```
### Possible Solution
_No response_
### Additional Information/Context
If I had to create a new vault, I'd probably go for the (L1) `CfnBackupVault` construct, but here we're talking about an existing (L2) vault, which I'm a bit reluctant to "convert" into its L1 version, in regard with its criticality.
Stack trace:
```txt
jsii.errors.JavaScriptError:
TypeError: Cannot read properties of undefined (reading 'keyArn')
at new BackupVault2 (/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/jsii-kernel-ux9aB5]/node_modules/aws-cdk-lib/aws-backup/lib/vault.js:1:7825)
at new BackupVault2 (/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/jsii-kernel-ux9aB5/node_modules/aws-cdk-lib/core/lib/prop-injectable.js:1:681)
at Kernel._Kernel_create (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:549:25)
at Kernel.create (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:219:93)
at KernelHost.processRequest (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15482:36)
at KernelHost.run (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15442:22)
at Immediate._onImmediate (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15443:45)
at process.processImmediate (node:internal/timers:491:21)
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "[…]/app.py", line 133, in
BackupStack(app, "Backup", "backup", cross_region_references = True)
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/stacks/backup/stack.py", line 20, in __init__
replica = BackupReplicaStack(self, "BackupReplica", "backupreplica",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/stacks/backup/replica.py", line 48, in __init__
self.vault = backup.BackupVault(self, "ReplicaBackupVault",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/aws_cdk/aws_backup/__init__.py", line 4329, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Cannot read properties of undefined (reading 'keyArn')
```
### AWS CDK Library version (aws-cdk-lib)
2.1031.1
### AWS CDK CLI version
2.221.1
### Node.js Version
v22.11.0
### OS
macOS 15.6.1
### Language
Python
### Language Version
3.12.12
### Other information
_No response_
Contributor guide
Research direction
Start with the BackupVault implementation and the shared-interface changes in the linked pull request diff. Run the Python reproduction using kms.CfnReplicaKey and backup.BackupVault, then compare behavior with kms.Key and kms.CfnKey. Done means BackupVault accepts all three key types without the keyArn error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100