aws / aws/aws-cdk

(events): EventBus.archive() does not forward `kmsKey` to the underlying Archive construct

Open
#38,298 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-events bug effort/medium p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

`EventBus.archive(id, props)` accepts a `kmsKey` property (declared on `BaseArchiveProps`, used to encrypt the archive with a customer-managed KMS key), but the implementation never forwards it to the `Archive` construct it creates internally. As a result, the archive silently falls back to the AWS-managed key even when a `kmsKey` is explicitly provided — there is no compile-time or runtime error, since `kmsKey` is a valid, typed property of `BaseArchiveProps`.

The relevant code in `packages/aws-cdk-lib/aws-events/lib/event-bus.ts`:

```ts
public archive(id: string, props: BaseArchiveProps): Archive {
return new Archive(this, id, {
sourceEventBus: this,
description: props.description || `Event Archive for ${this.eventBusName} Event Bus`,
eventPattern: props.eventPattern,
retention: props.retention,
archiveName: props.archiveName,
// props.kmsKey is never passed through
});
}
```

The `Archive` construct itself handles `kmsKey` correctly when constructed directly (`new Archive(scope, id, { kmsKey, sourceEventBus, ... })`), so the bug is isolated to this one forwarding call in the `EventBus.archive()` convenience method.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

N/A

### Expected Behavior

When calling `eventBus.archive(id, { ..., kmsKey })`, the synthesized `AWS::Events::Archive` CloudFormation resource should have `KmsKeyIdentifier` set to the provided key's ARN, and EventBridge should be granted the necessary KMS permissions on that key (as already happens when using the `Archive` construct directly).

### Current Behavior

The `kmsKey` property is silently ignored. The synthesized `AWS::Events::Archive` resource does not reference the customer-managed key, and the resulting archive is encrypted with the AWS-managed key instead. No warning or error is raised.

### Reproduction Steps

```ts
import { App, Stack, Duration } from 'aws-cdk-lib';
import { EventBus } from 'aws-cdk-lib/aws-events';
import { Key } from 'aws-cdk-lib/aws-kms';

const app = new App();
const stack = new Stack(app, 'ReproStack');

const key = new Key(stack, 'ArchiveKey');
const bus = new EventBus(stack, 'Bus');

const archive = bus.archive('Archive', {
eventPattern: { source: [{ prefix: '' }] },
retention: Duration.days(30),
kmsKey: key, // <-- silently dropped
});

// Synthesize and inspect the template: the AWS::Events::Archive resource
// has no KmsKeyIdentifier referencing `key`, even though it was provided above.
```

### Possible Solution

In `packages/aws-cdk-lib/aws-events/lib/event-bus.ts`, add `kmsKey: props.kmsKey` to the props object passed to `new Archive(...)` inside `EventBusBase.archive()`. This is a minimal, additive, backwards-compatible fix — `Archive` already treats `kmsKey` as optional and already contains the correct logic for granting KMS permissions when a key is supplied.

I have this solution applied in this PR: https://github.com/aws/aws-cdk/pull/38300

### Additional Information/Context

Discovered this while wiring up a KMS-encrypted EventBridge archive in our own CDK app. As a workaround, we're currently using the L1 escape hatch after calling `archive()`:

```ts
const archive = eventBus.archive('MyArchive', { eventPattern, kmsKey: standardKey });
const cfnArchive = archive.node.defaultChild as CfnArchive;
cfnArchive.kmsKeyIdentifier = standardKey.keyArn;
```

This may be related to #37847 (which covers a separate but adjacent issue: `Archive`/`CfnArchive` rendering an empty-string `KmsKeyIdentifier` when no key is configured at all), but is a distinct defect — this issue is about a key being provided but dropped, not about the empty-string default.

### AWS CDK Library version (aws-cdk-lib)

2.251.0

### AWS CDK CLI version

2.251.0

### Node.js Version

22.16.0

### OS

macOS (Darwin)

### Language

TypeScript

### Language Version

5.x

### Other information

PR with the fix: https://github.com/aws/aws-cdk/pull/38300

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-events/lib/event-bus.ts at EventBusBase.archive(), then synthesize the TypeScript reproduction with a customer-managed KMS key. Done means the generated AWS::Events::Archive includes KmsKeyIdentifier for the supplied key and retains the existing KMS permission behavior; compare with direct Archive construction and the linked PR.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.