AWS::Events::Archive : CDK 2.253.0 Generates Invalid Empty String for EventBridge Archive KmsKeyIdentifier Property
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Description
CDK version 2.253.0 introduced a breaking change in how it generates CloudFormation templates for EventBridge Archive resources. Specifically, CDK 2.253.0 now adds a KmsKeyIdentifier property with an empty string value ("KmsKeyIdentifier": "") to the Archive resource template, even when no KMS encryption is explicitly configured in the CDK code.
The AWS Events service rejects this empty string value with a GeneralServiceException because the KmsKeyIdentifier parameter must either:
- Contain a valid KMS key ARN/ID, or
- Be omitted entirely from the template
An empty string is not a valid value for this property. CDK 2.189.1 correctly omitted the KmsKeyIdentifier property when not configured, but CDK 2.253.0 incorrectly includes it with an empty string value.
This is a bug in the AWS CDK library version 2.253.0 that affects EventBridge Archive resources when no explicit KMS key is configured.
Working Template (CDK 2.189.1):
{
"Type": "AWS::Events::Archive",
"Properties": {
"ArchiveName": "my-archive-name",
"EventPattern": {
"source": [{"prefix": ""}]
},
"RetentionDays": 365,
"SourceArn": {"Fn::GetAtt": ["my-event-bus", "Arn"]}
}
}
Failing Template (CDK 2.253.0):
{
"Type": "AWS::Events::Archive",
"Properties": {
"ArchiveName": "my-archive-name",
"EventPattern": {
"source": [{"prefix": ""}]
},
"KmsKeyIdentifier": "",
"RetentionDays": 365,
"SourceArn": {"Fn::GetAtt": ["my-event-bus", "Arn"]}
}
}
Error Message:
Resource handler returned message: "Error occurred during operation 'AWS::Events::Archive'."
(RequestToken: aaaa-aaaa-aaaa-aaaa-aaaa, HandlerErrorCode: GeneralServiceException)
CDK Code (Unchanged Between Versions)
const eventBus = new EventBus(stack, 'my-event-bus', { eventBusName })
eventBus.archive('my-archive-name', {
archiveName: archiveAllName,
eventPattern: captureAllEventsPattern,
retention: Duration.days(365),
})
### Regression Issue
- [x] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
2.189.1
### Expected Behavior
Expected that if no KMS key is provided in the construct, no KMS key property will be generated in the CFN template (as before)
### Current Behavior
The construct generates an empty string for KMS property, which the service rejects.
### Reproduction Steps
const eventBus = new EventBus(stack, 'my-event-bus', { eventBusName })
eventBus.archive('my-archive-name', {
archiveName: archiveAllName,
eventPattern: captureAllEventsPattern,
retention: Duration.days(365),
})
### Possible Solution
Revert to previous behavior where KMS property does not appear in template unless specified in construct.
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.253.0
### AWS CDK CLI version
2.253.0
### Node.js Version
22.x
### OS
Windows
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start at the EventBus.archive entry point and inspect how an Archive is rendered into the CloudFormation template when no KMS key is configured. Run the supplied TypeScript reproduction and compare the generated template with the CDK 2.189.1 and 2.253.0 examples. Done means KmsKeyIdentifier is omitted without a key while configured keys remain represented correctly, with regression coverage added in the relevant AWS Events tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 63/100