Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

(aws-kms): Add support for MultiRegion Key with ReplicaKey

See original GitHub issue

KMS recently added support for MultiRegion KMS Keys with the MultiRegion boolean Property as part of Key and the ReplicaKey which can point to a Key that has MultiRegion set to true. This is required to support the new functionality that was released.

Use Case

Enables functional support already enabled in CloudFormation. Being able to manage key replication for DR purposes becomes easier.

Proposed Solution

First is to add the MultiRegion Property to the KeyProps interface

   * Creates a multi-Region primary CMK that you can replicate in other AWS Regions.
   * IMPORTANT: If you change the MultiRegion property of an existing CMK, the existing CMK is scheduled for
   * deletion and a new CMK is created with the specified Multi-Region value. While the scheduled deletion is
   * pending, you can't use the existing CMK. Unless you cancel the scheduled deletion of the CMK outside of
   * CloudFormation, all data encrypted under the existing CMK becomes unrecoverable when the CMK is deleted.
   * @default false
  readonly multiRegion?: boolean;

Then add the multiRegion property to the CfnKey resource

    const resource = new CfnKey(this, 'Resource', {
      description: props.description,
      enableKeyRotation: props.enableKeyRotation,
      enabled: props.enabled,
      keySpec: props.keySpec,
      keyUsage: props.keyUsage,
      keyPolicy: this.policy,
      multiRegion: props.multiRegion,
      pendingWindowInDays: pendingWindowInDays,

For the ReplicaKey, implement what is already in Cloudformation as referenced


  • 👋 I may be able to implement this feature request
  • ⚠️ This feature might incur a breaking change

This is a 🚀 Feature Request

Issue Analytics

  • State:open
  • Created 2 years ago
  • Reactions:34
  • Comments:10 (4 by maintainers)

github_iconTop GitHub Comments

dhawalschumicommented, Jan 13, 2022

We tried using escape hatches for use case wherein Primary Key is in us-east-1 region and replica keys are in us-west-2 and eu-west-1 regions. We ran into Cross Stack Reference issue while passing primary key arn to replica keys of us-west-2 and eu-west-1 regions.

Exception - Stack “Replica Key Stack” cannot consume a cross reference from stack “Primary Key Stack”. Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack

What are the possible solutions we can try here?

dhawalschumicommented, Feb 25, 2022

@Lilja - Given there is no way as of now, we went ahead with creating keys via AWS CLI and used they KMS Key Ids for our global table use case.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Multi-Region keys in AWS KMS - AWS Key Management Service
AWS KMS creates the replica keys with the same shared property values as those of the primary key. Then, it periodically synchronizes the...
Read more >
Creating multi-Region replica keys - AWS Documentation
You can create a multi-Region replica key in the AWS KMS console, by using the ReplicateKey operation, or by using a AWS CloudFormation...
Read more >
KMS Multi-Region Keys - Amazon AWS
AWS Key Management Service (AWS KMS) is introducing multi-Region keys, a new capability that lets you replicate keys from one AWS Region ...
Read more >
Managing multi-Region keys - AWS Documentation
When AWS KMS rotates the key material, it creates new key material for the primary key and then copies the new key material...
Read more >
replicate-key — AWS CLI 1.27.37 Command Reference
This operation supports multi-Region keys , an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found