(aws-kms/aws-sqs): Invalid Alias ARN generated for SQS encryptionMasterKey

[prashantgohel1]

Describe the bug

When using Alias.fromAliasName('name') static method to refer to the KMS key generated outside of the stack, the returned key ARN is not compliant with SQS encryption settings.

Expected Behavior

{
   "Type": "AWS::SQS::Queue",
   "Properties": {
    "KmsMasterKeyId": "arn:aws:kms:us-west-2:618350728704:alias/aliasName",
    "QueueName": "testQueue",
...
   },
  },

Keyword alias is missing in generated ARN.

• SQS doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html#cfn-sqs-queue-kmsmasterkeyid
• KMS doc: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-alias.html

Current Behavior

Invalid alias ARN is generated from https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-kms/lib/alias.ts#L63-L67

Reproduction Steps

CDK constructs:

const alias = Alias.fromAliasName(this, `id`, `aliasName`);
const queueProperties: QueueProps = {
      queueName: `testQueue`,
      encryption: QueueEncryption.KMS,
      encryptionMasterKey: alias,
    };
    this.queue = new Queue(this, `id2`, queueProperties);

Generated CFN template as :

{
   "Type": "AWS::SQS::Queue",
   "Properties": {
    "KmsMasterKeyId": {
     "Fn::Join": [
      "",
      [
       "arn:",
       {
        "Ref": "AWS::Partition"
       },
       ":kms:us-west-2:${ACCOUNT_ID}:aliasName"
      ]
     ]
    },
    "QueueName": "testQueue",
...
   },
  },

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

v2.103.1

Framework Version

No response

Node.js Version

18

OS

macOS

Language

TypeScript

Language Version

TypeScript 5.0.3

Other information

No response

[msambol]

I'll take this.

[msambol]

@prashantgohel1 If you list aliases with the CLI, you'll see alias/ is part of AliasName.

{
    "Aliases": [
        {
            "AliasName": "alias/aws/acm",
...

The docs here show examples using the full alias name. Make sure you have alias/ prefixed when using Alias.fromAliasName(). The Console hides alias/ which is maybe where the confusion is.

[prashantgohel1]

That makes sense. Thanks! Just for visibility the code above needs to be changed as

const alias = Alias.fromAliasName(this, `id`, `alias/aliasName`);

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.