diff --git a/src/main/java/io/github/hectorvent/floci/services/kms/KmsService.java b/src/main/java/io/github/hectorvent/floci/services/kms/KmsService.java
index 42a82e8c69..99668a0a46 100644
--- a/src/main/java/io/github/hectorvent/floci/services/kms/KmsService.java
+++ b/src/main/java/io/github/hectorvent/floci/services/kms/KmsService.java
@@ -576,12 +576,12 @@ public void createAlias(String aliasName, String targetKeyId, String region) {
         if (!aliasName.startsWith("alias/")) {
             throw new AwsException("InvalidAliasNameException", "Alias name must begin with 'alias/'", 400);
         }
-        resolveKey(targetKeyId, region); // Validate key exists
+        KmsKey key = resolveKey(targetKeyId, region); // Validate key exists and normalize to plain key ID
 
         String aliasArn = regionResolver.buildArn("kms", region, aliasName);
-        KmsAlias alias = new KmsAlias(aliasName, aliasArn, targetKeyId);
+        KmsAlias alias = new KmsAlias(aliasName, aliasArn, key.getKeyId());
         aliasStore.put(region + "::" + aliasName, alias);
-        LOG.infov("Created KMS alias: {0} -> {1}", aliasName, targetKeyId);
+        LOG.infov("Created KMS alias: {0} -> {1}", aliasName, key.getKeyId());
     }
 
     public void deleteAlias(String aliasName, String region) {
diff --git a/src/test/java/io/github/hectorvent/floci/services/kms/KmsServiceTest.java b/src/test/java/io/github/hectorvent/floci/services/kms/KmsServiceTest.java
index 293ba1dc2a..59ed08dd06 100644
--- a/src/test/java/io/github/hectorvent/floci/services/kms/KmsServiceTest.java
+++ b/src/test/java/io/github/hectorvent/floci/services/kms/KmsServiceTest.java
@@ -524,6 +524,15 @@ void resolveKeyByAlias() {
         assertEquals(key.getKeyId(), resolved.getKeyId());
     }
 
+    @Test
+    void resolveKeyByAliasCreatedWithArn() {
+        KmsKey key = kmsService.createKey(null, REGION);
+        kmsService.createAlias("alias/by-arn", key.getArn(), REGION);
+
+        KmsKey resolved = kmsService.describeKey("alias/by-arn", REGION);
+        assertEquals(key.getKeyId(), resolved.getKeyId());
+    }
+
     @Test
     void encryptAndDecryptWithId() {
         KmsKey key = kmsService.createKey(null, REGION);