aws / aws/aws-cdk

(aws-kms): Key Alias does not inherit the key's removal policy

Open Beginner friendly
#38,217 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-kms effort/small feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Aliases defined on a KMS key do not inherit the retention policy of the key. KMS Key's [default](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-kms/lib/key.ts#L537-L543) is to `RETAIN`. This occurs both in the interface `alias?`, and in the `addAlias` function:

```
/**
* Defines a new alias for the key.
*/
public addAlias(aliasName: string): Alias {
const aliasId = this.aliases.length > 0 ? `Alias${aliasName}` : 'Alias';

const alias = new Alias(this, aliasId, { aliasName, targetKey: this });
this.aliases.push(alias);

return alias;
}
```

The consequence for is that although a KMS key can be protected from deletion the alias will not. The deletion of the alias causes trust policies that use the alias for permission scoping to fail. For my service this resulted in an outage.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

I expected the KMS key and its properties to be retained

### Current Behavior

The key has the removal policy applied [here](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-kms/lib/key.ts#L878), but that same setting is not applied to alias. The stack events demonstrate this disconnect:

```
Endpointuswest2KmsKeyD3380D41 | DELETE_SKIPPED
Endpointuswest2KmsKeyAliasD3520F07 | DELETE_IN_PROGRESS
Endpointuswest2KmsKeyAliasD3520F07 | DELETE_COMPLETE
```

### Reproduction Steps

Define a key, give it an alias, and then delete the stack.

```
new kms.Key(scope, `some-id`, {
alias: 'very-important-name',
})
```

### Possible Solution

The interface option for `alias?` should inherit the removal policy of the key as should the `addAlias` function.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.259.0

### AWS CDK CLI version

2.1019.1

### Node.js Version

20.0

### OS

5.10.258-259.1041.amzn2int.x86_64

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-kms/lib/key.ts, reading the alias option and addAlias implementation and comparing them with the key removal-policy handling around line 878. Reproduce the stack deletion described in the issue, then verify that both alias creation paths retain the alias alongside a retained key.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.