Skip to content

[KMS] Support full ARN as TargetKeyId in update_alias#9841

Open
raajheshkannaa wants to merge 4 commits intogetmoto:masterfrom
raajheshkannaa:fix/kms-alias-arn-support
Open

[KMS] Support full ARN as TargetKeyId in update_alias#9841
raajheshkannaa wants to merge 4 commits intogetmoto:masterfrom
raajheshkannaa:fix/kms-alias-arn-support

Conversation

@raajheshkannaa
Copy link
Contributor

Summary

  • update_alias now resolves ARN to raw key ID using get_key_id(), matching the existing create_alias behavior
  • Fixed _set_alias API handler that incorrectly deleted the alias before calling update_alias, causing a KeyError when the method tried to find and move the alias
  • Added alias existence validation on the update path to return a proper NotFoundException instead of an unhandled KeyError
  • Updated Alias.target_key_id when moving an alias to a new key so list_aliases returns the correct target

Tests

  • test_update_alias_using_arn_as_target_key_id: direct API test for update_alias with full ARN
  • test_alias_create_and_update_with_arn: CloudFormation test for create + update with full ARN
  • Full KMS test suite: 245/245 passing

Fixes #9831

Resolve ARN to raw key ID in update_alias using get_key_id(), matching
the existing behavior of create_alias. Also fix the _set_alias API
handler which incorrectly deleted the alias before calling update_alias,
causing a KeyError when the alias could not be found.

Fixes getmoto#9831
@codecov
Copy link

codecov bot commented Mar 10, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.12%. Comparing base (830a798) to head (3d91cf4).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #9841   +/-   ##
=======================================
  Coverage   93.11%   93.12%           
=======================================
  Files        1308     1308           
  Lines      118862   118863    +1     
=======================================
+ Hits       110684   110688    +4     
+ Misses       8178     8175    -3     
Flag Coverage Δ
servertests 28.89% <0.00%> (-0.01%) ⬇️
unittests 93.09% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

raajheshkannaa and others added 3 commits March 10, 2026 12:02
- verify TargetKeyId resolves to key ID (not ARN) after alias update
- use ARN in same-target-key test to cover the no-op return path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Suport for cloudformation AWS::KMS::Alias resource does not support Full ARN as TargetKeyId

1 participant