serverless-kms-secrets
serverless-kms-secrets copied to clipboard
KMS key alias does not work when specified in config
If I replace the keyArn
property in the secrets YAML file with the alias of the KMS key, creation of new secrets fails:
keyArn: 'arn:aws:kms:us-east-1:xxxxxxxx:alias/my-test-key'
Serverless: Encrypting using key my-test-key found in secrets.yml
Serverless: ServerlessError: Invalid keyId
Looks like it's just taking the value after the last / which works fine when its the Id of a Key but when it's an alias it drops the "alias/" from the value its using which is what results in your "Invalid keyId" error.
arn:aws:kms:us-west-2:1234567890:alias/my-alias arn:aws:kms:us-west-2:1234567890:key/1111-2222-333-444-5555555
https://github.com/nordcloud/serverless-kms-secrets/blob/master/index.js#L130
it would be nice if the plugin supported storing the alias in the config file keyArn when that's what was used on the command line to generate the encrypted values.