Skip to content

feat(aws-cdk-lib/aws-kms): Allow testing for the existence of a KMS key by alias name #31574

@neoakris

Description

@neoakris

Describe the feature

Here's a code snippet for some context:

import * as kms from 'aws-cdk-lib/aws-kms';
let kmsKey = kms.Key.fromLookup(stack, "pre-existing-kms-key", { aliasName: "alias/eks/test" })

Current State of CDK 2.133.0:

  • The above logic works when a kms-key with alias "eks/test" exists.
  • If no key exists, then the program stops with error
    [Error at /$STACK_NAME] Could not find any key with alias named eks/test
    I tried wrapping the above in try catch logic, but the program still does a hard stop with the above error as soon as it discovers the key doesn't exist.

Feature Request/Proposed Solution:

  • Update logic:
    If no key exists, instead of an error, return undefined. This will make it easier to allow if statements to handle that scenario.

Use Case

While using EKS Blueprints, every time I delete and recreate a cluster (semi-frequently for ephemeral sandbox / test environments), due to its defaults it'll create a new KMS key each time, then on delete I get orphaned kms keys.
EKS Blueprints allows passing in a pre-existing kms key to avoid this.

However I'd like to add logic for the following use case:

  1. specify a desired kms alias
  2. detect if it exists
  3. if not exist: create new key with kms alias, and use the newly created kms key.
  4. if exists: use kms key with alias.

Basically I wanted to be able to create a function named ensure_existence_of_kms_key_with_alias()

This will allow me to implement logic where when I create a cluster it'll create a kms key, but if I delete and recreate the cluster it'll reuse the original kms key. (This avoids orphaned keys, and is also advantageous in the scenario of if disk backups were ever created using a kms key, then restore might be easier if a consistent kms key were used.)

Other Information

The proposed feature/solution shouldn't be a breaking change.

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

CDK version used

2.133.0 (build dcc1e75)

Environment details (OS name and version, etc.)

MacOS Sonoma 14.6.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-kmsRelated to AWS Key Managementeffort/smallSmall work item – less than a day of effortfeature-requestA feature should be added or improved.p3

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions