aws / aws/aws-cdk

AWS::Events::Archive : CDK 2.253.0 Generates Invalid Empty String for EventBridge Archive KmsKeyIdentifier Property

Open
#37,847 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-events bug effort/small p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Description

CDK version 2.253.0 introduced a breaking change in how it generates CloudFormation templates for EventBridge Archive resources. Specifically, CDK 2.253.0 now adds a KmsKeyIdentifier property with an empty string value ("KmsKeyIdentifier": "") to the Archive resource template, even when no KMS encryption is explicitly configured in the CDK code.

The AWS Events service rejects this empty string value with a GeneralServiceException because the KmsKeyIdentifier parameter must either:

- Contain a valid KMS key ARN/ID, or
- Be omitted entirely from the template

An empty string is not a valid value for this property. CDK 2.189.1 correctly omitted the KmsKeyIdentifier property when not configured, but CDK 2.253.0 incorrectly includes it with an empty string value.

This is a bug in the AWS CDK library version 2.253.0 that affects EventBridge Archive resources when no explicit KMS key is configured.

Working Template (CDK 2.189.1):

{
"Type": "AWS::Events::Archive",
"Properties": {
"ArchiveName": "my-archive-name",
"EventPattern": {
"source": [{"prefix": ""}]
},
"RetentionDays": 365,
"SourceArn": {"Fn::GetAtt": ["my-event-bus", "Arn"]}
}
}

Failing Template (CDK 2.253.0):

{
"Type": "AWS::Events::Archive",
"Properties": {
"ArchiveName": "my-archive-name",
"EventPattern": {
"source": [{"prefix": ""}]
},
"KmsKeyIdentifier": "",
"RetentionDays": 365,
"SourceArn": {"Fn::GetAtt": ["my-event-bus", "Arn"]}
}
}

Error Message:

Resource handler returned message: "Error occurred during operation 'AWS::Events::Archive'."
(RequestToken: aaaa-aaaa-aaaa-aaaa-aaaa, HandlerErrorCode: GeneralServiceException)

CDK Code (Unchanged Between Versions)

const eventBus = new EventBus(stack, 'my-event-bus', { eventBusName })
eventBus.archive('my-archive-name', {
archiveName: archiveAllName,
eventPattern: captureAllEventsPattern,
retention: Duration.days(365),
})

### Regression Issue

- [x] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

2.189.1

### Expected Behavior

Expected that if no KMS key is provided in the construct, no KMS key property will be generated in the CFN template (as before)

### Current Behavior

The construct generates an empty string for KMS property, which the service rejects.

### Reproduction Steps

const eventBus = new EventBus(stack, 'my-event-bus', { eventBusName })
eventBus.archive('my-archive-name', {
archiveName: archiveAllName,
eventPattern: captureAllEventsPattern,
retention: Duration.days(365),
})

### Possible Solution

Revert to previous behavior where KMS property does not appear in template unless specified in construct.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.253.0

### AWS CDK CLI version

2.253.0

### Node.js Version

22.x

### OS

Windows

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the EventBus.archive entry point and inspect how an Archive is rendered into the CloudFormation template when no KMS key is configured. Run the supplied TypeScript reproduction and compare the generated template with the CDK 2.189.1 and 2.253.0 examples. Done means KmsKeyIdentifier is omitted without a key while configured keys remain represented correctly, with regression coverage added in the relevant AWS Events tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
63/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.