fix(kms): normalize alias targetKeyId to plain key ID on createAlias

[mikelamutxastegi]

Summary

createAlias stored the targetKeyId parameter as-is in KmsAlias, without normalizing it to the plain key UUID. When a caller passed a full key ARN (e.g. arn:aws:kms:us-east-1:000000000000:key/<uuid>) as targetKeyId, the raw ARN was persisted. On any subsequent operation that resolved the key through that alias (e.g. DescribeKey, Encrypt, Decrypt), resolveKey retrieved the stored ARN and used it directly as the storage lookup key (region + "::" + arn), which never matched the entry stored as region + "::" + uuid — causing a NotFoundException.

The fix captures the result of resolveKey (which already handles ARN, alias ARN, and alias name normalization) in createAlias and stores key.getKeyId() — the plain UUID — in the alias instead of the raw input.

A regression test resolveKeyByAliasCreatedWithArn is added to KmsServiceTest to cover this path.

Closes #1647

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

Incorrect behavior:

CreateAlias accepted a full key ARN as TargetKeyId but stored it verbatim, causing any subsequent resolution through that alias (e.g. DescribeKey, Encrypt, Decrypt) to fail with NotFoundException. The AWS SDK and CLI always pass the ARN form in some flows, so this broke real-world SDK usage.

Updated behavior:

createAlias now normalizes TargetKeyId to the plain key UUID regardless of whether a plain ID, full ARN, or alias ARN is supplied, matching the AWS KMS behavior where aliases always resolve correctly.

Checklist

• ./mvnw test passes locally
• New or updated unit test added (resolveKeyByAliasCreatedWithArn in KmsServiceTest)
• Commit messages follow Conventional Commits

[greptile-apps]

Greptile Summary

This PR fixes a normalization bug in KmsService.createAlias where a targetKeyId supplied as a full key ARN was stored verbatim in KmsAlias, causing alias-based key resolution to fail with NotFoundException on any subsequent operation.

• createAlias now captures the return value of the existing resolveKey call (which already normalizes ARNs, alias ARNs, and alias names to a plain UUID) and stores key.getKeyId() instead of the raw targetKeyId string.
• A new regression test resolveKeyByAliasCreatedWithArn is added to KmsServiceTest, exercising the ARN-as-targetKeyId path end-to-end through createAlias → describeKey.

Confidence Score: 5/5

Safe to merge — a minimal, well-scoped fix that reuses an already-trusted helper and is directly covered by a new regression test.

The change is a one-line capture of an existing resolveKey() return value; the normalization logic itself is unchanged and already exercised broadly across the service. The new test exercises the exact previously-broken path (createAlias with a key ARN, then describeKey via the alias), and the fix does not touch any other code path.

No files require special attention.

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/kms/KmsService.java	Single-line fix in createAlias: captures the resolveKey() return value and stores key.getKeyId() instead of the raw targetKeyId, correctly normalizing ARN/alias inputs to plain UUIDs.
src/test/java/io/github/hectorvent/floci/services/kms/KmsServiceTest.java	Adds resolveKeyByAliasCreatedWithArn test that creates an alias using a full key ARN then verifies describeKey resolves it correctly — direct coverage for the fixed code path.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Caller
    participant KmsService
    participant aliasStore
    participant keyStore

    Note over Caller,keyStore: Before fix — ARN stored verbatim, resolution fails
    Caller->>KmsService: createAlias("alias/foo", "arn:aws:kms:.../key/uuid")
    KmsService->>keyStore: resolveKey(arn) → key (result discarded)
    KmsService->>aliasStore: "put(alias/foo → targetKeyId = full ARN)"
    Caller->>KmsService: describeKey("alias/foo")
    KmsService->>aliasStore: get(alias/foo) → full ARN
    KmsService->>keyStore: get(region + "::" + arn) → NotFoundException ❌

    Note over Caller,keyStore: After fix — UUID normalized and stored, resolution succeeds
    Caller->>KmsService: createAlias("alias/foo", "arn:aws:kms:.../key/uuid")
    KmsService->>keyStore: resolveKey(arn) → key (result captured)
    KmsService->>aliasStore: "put(alias/foo → targetKeyId = key.getKeyId() = uuid)"
    Caller->>KmsService: describeKey("alias/foo")
    KmsService->>aliasStore: get(alias/foo) → uuid
    KmsService->>keyStore: get(region + "::" + uuid) → key ✅

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Caller
    participant KmsService
    participant aliasStore
    participant keyStore

    Note over Caller,keyStore: Before fix — ARN stored verbatim, resolution fails
    Caller->>KmsService: createAlias("alias/foo", "arn:aws:kms:.../key/uuid")
    KmsService->>keyStore: resolveKey(arn) → key (result discarded)
    KmsService->>aliasStore: "put(alias/foo → targetKeyId = full ARN)"
    Caller->>KmsService: describeKey("alias/foo")
    KmsService->>aliasStore: get(alias/foo) → full ARN
    KmsService->>keyStore: get(region + "::" + arn) → NotFoundException ❌

    Note over Caller,keyStore: After fix — UUID normalized and stored, resolution succeeds
    Caller->>KmsService: createAlias("alias/foo", "arn:aws:kms:.../key/uuid")
    KmsService->>keyStore: resolveKey(arn) → key (result captured)
    KmsService->>aliasStore: "put(alias/foo → targetKeyId = key.getKeyId() = uuid)"
    Caller->>KmsService: describeKey("alias/foo")
    KmsService->>aliasStore: get(alias/foo) → uuid
    KmsService->>keyStore: get(region + "::" + uuid) → key ✅

Loading

_{Reviews (3): Last reviewed commit: "fix(kms): normalize alias targetKeyId to..." | Re-trigger Greptile}

[hectorvent]

Thanks @mikelamutxastegi,
Solid fix implementation