aws / aws/aws-cdk

(appconfig): HostedConfiguration KMS Key fails to meet pattern constraint

Open
#36,819 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-appconfig bug needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When creating a new AppConfig `HostedConfigfuration` construct and passing in a `kmsKey` property, the Stack fails to deploy due to a `#/KmsKeyIdentifier: failed validation constraint for keyword [pattern]` error.

The root cause is that the CloudFormation pattern for the `KmsKeyIdentifier` does not contain a matcher for the account portion of the Key ARN. I have opened a case with AWS, and they have confirmed this to be the case, however they have suggested that I use one of the other acceptable values such as the Key ID without giving an ETA on if/when this will be addressed.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

AppConfig `HostedConfigfuration` construct generates and deploys `AWS::AppConfig::ConfigurationProfile` with a `KmsKeyIdentifier` successfully.

### Current Behavior

AppConfig `HostedConfigfuration` construct generates and fails to deploy `AWS::AppConfig::ConfigurationProfile` with a `KmsKeyIdentifier` with the following error: `#/KmsKeyIdentifier: failed validation constraint for keyword [pattern]`

### Reproduction Steps

```typescript
const key = new kms.Key(this, 'Key');
const application = new appconfig.Application(this, 'Application');
new appconfig.HostedConfiguration(this, 'HostedConfig', {
application,
content: appconfig.ConfigurationContent.fromInlineText('Test configuration'),
kmsKey: key,
});
```

### Possible Solution

I believe the following change would fix the issue.

```typescript
- kmsKeyIdentifier: props.kmsKey?.keyRef.keyArn,
+ kmsKeyIdentifier: props.kmsKey?.keyRef.keyId,
```

Link to source for ref: [kmsKeyIdentifier: props.kmsKey?.keyRef.keyArn,](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-appconfig/lib/configuration.ts#L481)

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.236.0

### AWS CDK CLI version

2.1100.3

### Node.js Version

22

### OS

Windows

### Language

TypeScript

### Language Version

5

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-appconfig/lib/configuration.ts around the referenced kmsKeyIdentifier assignment at line 481, then reproduce the issue with the TypeScript example in the report. Verify that HostedConfiguration produces an AWS::AppConfig::ConfigurationProfile whose KmsKeyIdentifier satisfies CloudFormation validation and deploys successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.