-
Notifications
You must be signed in to change notification settings - Fork 4.5k
feat(aws-cdk-lib/aws-kms): Allow testing for the existence of a KMS key by alias name #31574
Description
Describe the feature
Here's a code snippet for some context:
import * as kms from 'aws-cdk-lib/aws-kms';
let kmsKey = kms.Key.fromLookup(stack, "pre-existing-kms-key", { aliasName: "alias/eks/test" })Current State of CDK 2.133.0:
- The above logic works when a kms-key with alias "eks/test" exists.
- If no key exists, then the program stops with error
[Error at /$STACK_NAME] Could not find any key with alias named eks/test
I tried wrapping the above in try catch logic, but the program still does a hard stop with the above error as soon as it discovers the key doesn't exist.
Feature Request/Proposed Solution:
- Update logic:
If no key exists, instead of an error, return undefined. This will make it easier to allow if statements to handle that scenario.
Use Case
While using EKS Blueprints, every time I delete and recreate a cluster (semi-frequently for ephemeral sandbox / test environments), due to its defaults it'll create a new KMS key each time, then on delete I get orphaned kms keys.
EKS Blueprints allows passing in a pre-existing kms key to avoid this.
However I'd like to add logic for the following use case:
- specify a desired kms alias
- detect if it exists
- if not exist: create new key with kms alias, and use the newly created kms key.
- if exists: use kms key with alias.
Basically I wanted to be able to create a function named ensure_existence_of_kms_key_with_alias()
This will allow me to implement logic where when I create a cluster it'll create a kms key, but if I delete and recreate the cluster it'll reuse the original kms key. (This avoids orphaned keys, and is also advantageous in the scenario of if disk backups were ever created using a kms key, then restore might be easier if a consistent kms key were used.)
Other Information
The proposed feature/solution shouldn't be a breaking change.
Acknowledgements
- I may be able to implement this feature request
- This feature might incur a breaking change
CDK version used
2.133.0 (build dcc1e75)
Environment details (OS name and version, etc.)
MacOS Sonoma 14.6.1