(aws-kms): Add support for MultiRegion Key with ReplicaKey

KMS recently added support for MultiRegion KMS Keys with the MultiRegion boolean Property as part of Key and the ReplicaKey which can point to a Key that has MultiRegion set to true. This is required to support the new functionality that was released.

Use Case

Enables functional support already enabled in CloudFormation. Being able to manage key replication for DR purposes becomes easier.

Proposed Solution

First is to add the MultiRegion Property to the KeyProps interface

  /**
   * Creates a multi-Region primary CMK that you can replicate in other AWS Regions.
   * 
   * IMPORTANT: If you change the MultiRegion property of an existing CMK, the existing CMK is scheduled for
   * deletion and a new CMK is created with the specified Multi-Region value. While the scheduled deletion is
   * pending, you can't use the existing CMK. Unless you cancel the scheduled deletion of the CMK outside of
   * CloudFormation, all data encrypted under the existing CMK becomes unrecoverable when the CMK is deleted.
   * 
   * @default false
   */
  readonly multiRegion?: boolean;

Then add the multiRegion property to the CfnKey resource

    const resource = new CfnKey(this, 'Resource', {
      description: props.description,
      enableKeyRotation: props.enableKeyRotation,
      enabled: props.enabled,
      keySpec: props.keySpec,
      keyUsage: props.keyUsage,
      keyPolicy: this.policy,
      multiRegion: props.multiRegion,
      pendingWindowInDays: pendingWindowInDays,
    });

For the ReplicaKey, implement what is already in Cloudformation as referenced https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-replicakey.html

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[dhawalschumi]

We tried using escape hatches for use case wherein Primary Key is in us-east-1 region and replica keys are in us-west-2 and eu-west-1 regions. We ran into Cross Stack Reference issue while passing primary key arn to replica keys of us-west-2 and eu-west-1 regions.

Exception - Stack “Replica Key Stack” cannot consume a cross reference from stack “Primary Key Stack”. Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack

What are the possible solutions we can try here?

[dhawalschumi]

@Lilja - Given there is no way as of now, we went ahead with creating keys via AWS CLI and used they KMS Key Ids for our global table use case.