(events): EventBus.archive() does not forward `kmsKey` to the underlying Archive construct
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
`EventBus.archive(id, props)` accepts a `kmsKey` property (declared on `BaseArchiveProps`, used to encrypt the archive with a customer-managed KMS key), but the implementation never forwards it to the `Archive` construct it creates internally. As a result, the archive silently falls back to the AWS-managed key even when a `kmsKey` is explicitly provided — there is no compile-time or runtime error, since `kmsKey` is a valid, typed property of `BaseArchiveProps`.
The relevant code in `packages/aws-cdk-lib/aws-events/lib/event-bus.ts`:
```ts
public archive(id: string, props: BaseArchiveProps): Archive {
return new Archive(this, id, {
sourceEventBus: this,
description: props.description || `Event Archive for ${this.eventBusName} Event Bus`,
eventPattern: props.eventPattern,
retention: props.retention,
archiveName: props.archiveName,
// props.kmsKey is never passed through
});
}
```
The `Archive` construct itself handles `kmsKey` correctly when constructed directly (`new Archive(scope, id, { kmsKey, sourceEventBus, ... })`), so the bug is isolated to this one forwarding call in the `EventBus.archive()` convenience method.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
N/A
### Expected Behavior
When calling `eventBus.archive(id, { ..., kmsKey })`, the synthesized `AWS::Events::Archive` CloudFormation resource should have `KmsKeyIdentifier` set to the provided key's ARN, and EventBridge should be granted the necessary KMS permissions on that key (as already happens when using the `Archive` construct directly).
### Current Behavior
The `kmsKey` property is silently ignored. The synthesized `AWS::Events::Archive` resource does not reference the customer-managed key, and the resulting archive is encrypted with the AWS-managed key instead. No warning or error is raised.
### Reproduction Steps
```ts
import { App, Stack, Duration } from 'aws-cdk-lib';
import { EventBus } from 'aws-cdk-lib/aws-events';
import { Key } from 'aws-cdk-lib/aws-kms';
const app = new App();
const stack = new Stack(app, 'ReproStack');
const key = new Key(stack, 'ArchiveKey');
const bus = new EventBus(stack, 'Bus');
const archive = bus.archive('Archive', {
eventPattern: { source: [{ prefix: '' }] },
retention: Duration.days(30),
kmsKey: key, // <-- silently dropped
});
// Synthesize and inspect the template: the AWS::Events::Archive resource
// has no KmsKeyIdentifier referencing `key`, even though it was provided above.
```
### Possible Solution
In `packages/aws-cdk-lib/aws-events/lib/event-bus.ts`, add `kmsKey: props.kmsKey` to the props object passed to `new Archive(...)` inside `EventBusBase.archive()`. This is a minimal, additive, backwards-compatible fix — `Archive` already treats `kmsKey` as optional and already contains the correct logic for granting KMS permissions when a key is supplied.
I have this solution applied in this PR: https://github.com/aws/aws-cdk/pull/38300
### Additional Information/Context
Discovered this while wiring up a KMS-encrypted EventBridge archive in our own CDK app. As a workaround, we're currently using the L1 escape hatch after calling `archive()`:
```ts
const archive = eventBus.archive('MyArchive', { eventPattern, kmsKey: standardKey });
const cfnArchive = archive.node.defaultChild as CfnArchive;
cfnArchive.kmsKeyIdentifier = standardKey.keyArn;
```
This may be related to #37847 (which covers a separate but adjacent issue: `Archive`/`CfnArchive` rendering an empty-string `KmsKeyIdentifier` when no key is configured at all), but is a distinct defect — this issue is about a key being provided but dropped, not about the empty-string default.
### AWS CDK Library version (aws-cdk-lib)
2.251.0
### AWS CDK CLI version
2.251.0
### Node.js Version
22.16.0
### OS
macOS (Darwin)
### Language
TypeScript
### Language Version
5.x
### Other information
PR with the fix: https://github.com/aws/aws-cdk/pull/38300
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-events/lib/event-bus.ts at EventBusBase.archive(), then synthesize the TypeScript reproduction with a customer-managed KMS key. Done means the generated AWS::Events::Archive includes KmsKeyIdentifier for the supplied key and retains the existing KMS permission behavior; compare with direct Archive construction and the linked PR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100