(aws-kms): Key Alias does not inherit the key's removal policy
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Aliases defined on a KMS key do not inherit the retention policy of the key. KMS Key's [default](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-kms/lib/key.ts#L537-L543) is to `RETAIN`. This occurs both in the interface `alias?`, and in the `addAlias` function:
```
/**
* Defines a new alias for the key.
*/
public addAlias(aliasName: string): Alias {
const aliasId = this.aliases.length > 0 ? `Alias${aliasName}` : 'Alias';
const alias = new Alias(this, aliasId, { aliasName, targetKey: this });
this.aliases.push(alias);
return alias;
}
```
The consequence for is that although a KMS key can be protected from deletion the alias will not. The deletion of the alias causes trust policies that use the alias for permission scoping to fail. For my service this resulted in an outage.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
I expected the KMS key and its properties to be retained
### Current Behavior
The key has the removal policy applied [here](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-kms/lib/key.ts#L878), but that same setting is not applied to alias. The stack events demonstrate this disconnect:
```
Endpointuswest2KmsKeyD3380D41 | DELETE_SKIPPED
Endpointuswest2KmsKeyAliasD3520F07 | DELETE_IN_PROGRESS
Endpointuswest2KmsKeyAliasD3520F07 | DELETE_COMPLETE
```
### Reproduction Steps
Define a key, give it an alias, and then delete the stack.
```
new kms.Key(scope, `some-id`, {
alias: 'very-important-name',
})
```
### Possible Solution
The interface option for `alias?` should inherit the removal policy of the key as should the `addAlias` function.
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.259.0
### AWS CDK CLI version
2.1019.1
### Node.js Version
20.0
### OS
5.10.258-259.1041.amzn2int.x86_64
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-kms/lib/key.ts, reading the alias option and addAlias implementation and comparing them with the key removal-policy handling around line 878. Reproduce the stack deletion described in the issue, then verify that both alias creation paths retain the alias alongside a retained key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100