Description

At the moment, it is possible to set encrypted: true in launchtemplate block device mappings, but you cannot specify the kms key used for encryption.

https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-blockdevicemapping-ebs.html#cfn-ec2-launchtemplate-blockdevicemapping-ebs-kmskeyid

Use Case

I want to specify the kms key used to encrypt the volume. I cross account share encrypted amis, but as they get started, they are encrypted with the default ebs kms key. I want to specify my own...

Proposed Solution

Add property referencing to an IKmsKey here:

Other information

Add property referencing to an kmskey here:

as it should be accepted by cloudformation:
https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-blockdevicemapping-ebs.html#cfn-ec2-launchtemplate-blockdevicemapping-ebs-kmskeyid

just checked it with a propertyOverride - the result is what I expected, but would be nice if this would be a native option of the cdk.

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change