(aws-redshift): KmsKeyId uses KeyArn instead of KeyId

[gkubes]

What is the problem?

When a Cluster is created the KmsKeyId property is built using the KeyArn instead of the KeyId.

Reproduction Steps

const encryptionKey = new kms.Key(this, "KMSKey", {
    enabled: true,
    enableKeyRotation: true
});

const wbrCluster = new redshift.Cluster(this, "WBRRedshiftCluster", {
    ...
    encrypted: true,
    encryptionKey: encryptionKey,
    
});

What did you expect to happen?

"KmsKeyId": {
  "Ref": "KMSKey"
},

or

"KmsKeyId": {
  "Fn::GetAtt": [
    "WBRDataKMSKey",
    "KeyId"
  ]
},

What actually happened?

"KmsKeyId": {
  "Fn::GetAtt": [
    "WBRDataKMSKey",
    "Arn"
  ]
},

CDK CLI Version

1.126.0

Framework Version

No response

Node.js Version

12.0

OS

Amazon Linux 2012

Language

Typescript

Language Version

No response

Other information

No response

[njlynch]

Thanks for the bug report.

I suspect this is because the Redshift Cluster construct was largely built off of the RDS Cluster; RDS' KmsKeyId does actually expect the ARN, not the Key ID.

Does this prevent successful deployment? Sometimes the documented standard is the ID, but the ARN is accepted as well.

Either way, this is a simple enough fix. Contributions welcome! Ideally, we'd update the integ test as well to deploy with a Key, to verify the behavior.

[gkubes]

I wasn't able to confirm if this prevents successful deployment but it can impact the ability to migrate from vanilla CFN to CDK because the change from KeyId to KeyArn triggers an encryption change in the cluster.

[gkubes]

As a workaround, I was able to comment out the encryptionKey property from the cluster definition and provide an override.

(cluster.node.defaultChild as redshift.CfnCluster).addPropertyOverride("KmsKeyId", encryptionKey.keyId);

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.