aws / aws/aws-cdk

(backup): BackupVault no longer compatible with kms.CfnReplicaKey

Open
#35,899 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/core feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

CDK 2.215.0 introduced new shared interfaces between L1 and L2 resources. Unfortunately the `backup.BackupVault` construct is not yet fully compatible with these interface.

Related code: https://github.com/aws/aws-cdk/pull/35032/files#diff-a31b96329c8b9697f18b560fd50662f96c62739f4513ada812cb6b17f39ecfb8

### Regression Issue

- [x] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

2.214.0

### Expected Behavior

`backup.BackupVault` should be compatible with `kms.Key`, `kms.CfnKey` and `kms.CfnReplicaKey`.

### Current Behavior

`backup.BackupVault` is not compatible with `kms.CfnReplicaKey`.

### Reproduction Steps

```python
cfn_replica_key = kms.CfnReplicaKey(self, …)

vault = backup.BackupVault(self, "BackupVault",
encryption_key = cfn_replica_key
)
```

### Possible Solution

_No response_

### Additional Information/Context

If I had to create a new vault, I'd probably go for the (L1) `CfnBackupVault` construct, but here we're talking about an existing (L2) vault, which I'm a bit reluctant to "convert" into its L1 version, in regard with its criticality.

Stack trace:
```txt
jsii.errors.JavaScriptError:
TypeError: Cannot read properties of undefined (reading 'keyArn')
at new BackupVault2 (/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/jsii-kernel-ux9aB5]/node_modules/aws-cdk-lib/aws-backup/lib/vault.js:1:7825)
at new BackupVault2 (/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/jsii-kernel-ux9aB5/node_modules/aws-cdk-lib/core/lib/prop-injectable.js:1:681)
at Kernel._Kernel_create (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:549:25)
at Kernel.create (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:219:93)
at KernelHost.processRequest (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15482:36)
at KernelHost.run (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15442:22)
at Immediate._onImmediate (/private/var/folders/mh/fv6nsy211xl_68mfyflgcrh00000gn/T/tmpehohao1c/lib/program.js:15443:45)
at process.processImmediate (node:internal/timers:491:21)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "[…]/app.py", line 133, in
BackupStack(app, "Backup", "backup", cross_region_references = True)
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/stacks/backup/stack.py", line 20, in __init__
replica = BackupReplicaStack(self, "BackupReplica", "backupreplica",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/stacks/backup/replica.py", line 48, in __init__
self.vault = backup.BackupVault(self, "ReplicaBackupVault",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/aws_cdk/aws_backup/__init__.py", line 4329, in __init__
jsii.create(self.__class__, self, [scope, id, props])

File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[…]/.venv/lib/python3.12/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Cannot read properties of undefined (reading 'keyArn')
```

### AWS CDK Library version (aws-cdk-lib)

2.1031.1

### AWS CDK CLI version

2.221.1

### Node.js Version

v22.11.0

### OS

macOS 15.6.1

### Language

Python

### Language Version

3.12.12

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the BackupVault implementation and the shared-interface changes in the linked pull request diff. Run the Python reproduction using kms.CfnReplicaKey and backup.BackupVault, then compare behavior with kms.Key and kms.CfnKey. Done means BackupVault accepts all three key types without the keyArn error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.