amplify-category-api
amplify-category-api copied to clipboard
updating KMS key of DynamoDB tables does not take effect
Environment information
System:
OS: Linux 6.8 Ubuntu 22.04.5 LTS 22.04.5 LTS (Jammy Jellyfish)
CPU: (8) x64 Intel(R) Xeon(R) Platinum 8488C
Memory: 24.58 GB / 30.82 GB
Shell: /usr/bin/zsh
Binaries:
Node: 20.18.0 - ~/.nvm/versions/node/v20.18.0/bin/node
Yarn: 1.22.22 - ~/.linuxbrew/homebrew/bin/yarn
npm: 10.8.2 - ~/.nvm/versions/node/v20.18.0/bin/npm
pnpm: 9.15.4 - ~/.nvm/versions/node/v20.18.0/bin/pnpm
NPM Packages:
@aws-amplify/auth-construct: 1.6.0
@aws-amplify/backend: 1.14.1
@aws-amplify/backend-ai: Not Found
@aws-amplify/backend-auth: 1.5.0
@aws-amplify/backend-cli: 1.4.11
@aws-amplify/backend-data: 1.4.0
@aws-amplify/backend-deployer: 1.1.17
@aws-amplify/backend-function: 1.12.2
@aws-amplify/backend-output-schemas: 1.4.0
@aws-amplify/backend-output-storage: 1.1.4
@aws-amplify/backend-secret: 1.1.6
@aws-amplify/backend-storage: 1.2.4
@aws-amplify/cli-core: 1.2.4
@aws-amplify/client-config: 1.5.7
@aws-amplify/data-construct: 1.14.6
@aws-amplify/data-schema: 1.17.4
@aws-amplify/deployed-backend-client: 1.5.0
@aws-amplify/form-generator: 1.0.4
@aws-amplify/model-generator: 1.0.12
@aws-amplify/platform-core: 1.6.3
@aws-amplify/plugin-types: 1.8.0
@aws-amplify/sandbox: 1.2.11
@aws-amplify/schema-generator: 1.2.7
aws-amplify: 6.13.1
aws-cdk: 2.1000.2
aws-cdk-lib: 2.180.0
typescript: 5.7.3
No AWS environment variables
No CDK environment variables
Data packages
[email protected] /data/git/ivt-portal
├─┬ @aws-amplify/[email protected]
│ └─┬ @aws-amplify/[email protected]
│ └── @aws-amplify/[email protected]
└─┬ @aws-amplify/[email protected]
└─┬ @aws-amplify/[email protected]
└── @aws-amplify/[email protected]
Description
I'm configuring the DDB zero-ETL to Redshift, which requires the DDB tables not to use the AWS-managed KMS key. So I created a KMS key and specified it to the table, but it does not take effect after updating the stack.
The example code looks like below:
const key = new Key(backend.stack, "My-Key", {
enableKeyRotation: true,
removalPolicy: RemovalPolicy.DESTROY,
pendingWindow: Duration.days(7),
});
const { amplifyDynamoDbTables } = backend.data.resources.cfnResources;
for (const amplifyTable of Object.values(amplifyDynamoDbTables)) {
amplifyTable.pointInTimeRecoveryEnabled = true;
amplifyTable.sseSpecification = {
kmsMasterKeyId: key.keyArn,
sseEnabled: true,
};
}
Due to the DDB in the data module being managed by the custom resource Custom::AmplifyDynamoDBTable, I did see the event parameter with the new key ID in the log, but the function did not update the table with the new KMS key.