fix(s3vectors): read EncryptionConfiguration with the CFn SseType / KmsKeyArn spellings (#1397)

Author: go-to-k

docs/_generated/integ-coverage.json

@@ -3555,7 +3555,8 @@
         "infra-security",
         "kms-encryption",
         "loggroup-kms-associate",
-        "propagation-races-2"
+        "propagation-races-2",
+        "s3-vectors"
       ],
       "signals": {
         "composite-stack": [
@@ -3582,6 +3583,9 @@
         ],
         "propagation-races-2": [
           "l1"
+        ],
+        "s3-vectors": [
+          "l2"
         ]
       }
     },

docs/_generated/integ-last-run.tsv

@@ -232,7 +232,7 @@ s3-lifecycle	2026-07-21T14:28:43Z	PASS	58	verify.sh	rc ok, orph clean
 s3-object-lock	2026-07-21T14:42:20Z	PASS	53	verify.sh	rc ok, orph clean
 s3-replication-and-filter	2026-07-21T14:43:45Z	PASS	63	verify.sh	rc ok, orph clean
 s3-tables	2026-07-27T16:53:47Z	PASS	45	verify.sh	issue #1270/#1272 post-review re-run; 5 del 0 err, 0 orphans
-s3-vectors	2026-07-26T18:49:34Z	PASS	43	verify.sh	0727b sweep-b6 staleness re-run (rc=0); account clean
+s3-vectors	2026-08-09T03:50:21Z	PASS	230	verify.sh	#1385 CMK encryption asserted; destroy 0 errors, 0 orphans
 scheduled-task	2026-07-26T18:04:53Z	PASS	44	standard	0727b sweep-b1 staleness re-run (rc=0); account clean
 scheduler-custom-group	2026-07-26T19:25:15Z	PASS	103	verify.sh	0727b sweep-b10 staleness re-run (rc=0); account clean
 schema-v5-to-v6-migration	2026-07-24T10:27:22Z	PASS	61	verify.sh	0724 P0 sweep: v5->v8 transparent upgrade verified; 1 del 0 err

docs/integ-coverage.md

@@ -124,7 +124,7 @@ Registered without an integ fixture, with an explicit `// allow-no-integ: <ratio
 | `AWS::IAM::User` | [`iam-access-key`](../tests/integration/iam-access-key/) (l2)<br>[`infra-security`](../tests/integration/infra-security/) (l2) |
 | `AWS::IAM::UserToGroupAddition` | [`infra-security`](../tests/integration/infra-security/) (literal) |
 | `AWS::KMS::Alias` | [`composite-stack`](../tests/integration/composite-stack/) (literal)<br>[`infra-security`](../tests/integration/infra-security/) (literal)<br>[`kms-encryption`](../tests/integration/kms-encryption/) (literal) |
-| `AWS::KMS::Key` | [`composite-stack`](../tests/integration/composite-stack/) (literal)<br>[`drift-revert`](../tests/integration/drift-revert/) (l2)<br>[`dynamodb-streams`](../tests/integration/dynamodb-streams/) (l2)<br>[`ecr-scanning`](../tests/integration/ecr-scanning/) (l2)<br>[`infra-security`](../tests/integration/infra-security/) (l2)<br>[`kms-encryption`](../tests/integration/kms-encryption/) (l2,literal)<br>[`loggroup-kms-associate`](../tests/integration/loggroup-kms-associate/) (l2)<br>[`propagation-races-2`](../tests/integration/propagation-races-2/) (l1) |
+| `AWS::KMS::Key` | [`composite-stack`](../tests/integration/composite-stack/) (literal)<br>[`drift-revert`](../tests/integration/drift-revert/) (l2)<br>[`dynamodb-streams`](../tests/integration/dynamodb-streams/) (l2)<br>[`ecr-scanning`](../tests/integration/ecr-scanning/) (l2)<br>[`infra-security`](../tests/integration/infra-security/) (l2)<br>[`kms-encryption`](../tests/integration/kms-encryption/) (l2,literal)<br>[`loggroup-kms-associate`](../tests/integration/loggroup-kms-associate/) (l2)<br>[`propagation-races-2`](../tests/integration/propagation-races-2/) (l1)<br>[`s3-vectors`](../tests/integration/s3-vectors/) (l2) |
 | `AWS::Kinesis::Stream` | [`cache-streaming`](../tests/integration/cache-streaming/) (l2)<br>[`dynamodb-ondemand`](../tests/integration/dynamodb-ondemand/) (l2)<br>[`kinesis-esm-filter`](../tests/integration/kinesis-esm-filter/) (l2)<br>[`kinesis-stream-mode-switch`](../tests/integration/kinesis-stream-mode-switch/) (l2)<br>[`log-pipeline`](../tests/integration/log-pipeline/) (l2)<br>[`replacement-immutable-name`](../tests/integration/replacement-immutable-name/) (l2,literal)<br>[`sdk-ccapi-crossref`](../tests/integration/sdk-ccapi-crossref/) (l1,literal) |
 | `AWS::KinesisFirehose::DeliveryStream` | [`log-pipeline`](../tests/integration/log-pipeline/) (l1,literal) |
 | `AWS::Lambda::EventInvokeConfig` | [`lambda-destinations`](../tests/integration/lambda-destinations/) (literal)<br>[`lambda-event-invoke-config-update`](../tests/integration/lambda-event-invoke-config-update/) (literal) |

src/provisioning/providers/s3-vectors-provider.ts

@@ -254,6 +254,12 @@ export class S3VectorsProvider implements ResourceProvider {
       );
     }
 
+    // CFn spells the two sub-keys `SseType` / `KmsKeyArn` (verified against the
+    // live `AWS::S3Vectors::VectorBucket` registry schema and CDK's
+    // `CfnVectorBucket` renderer) — NOT `SSEType` / `KMSKeyArn`. Reading the
+    // all-caps spellings made both lookups permanently `undefined`, so
+    // `CreateVectorBucket` silently shipped the account-default encryption
+    // instead of the requested KMS key (issue #1385).
     const encryptionConfiguration = properties['EncryptionConfiguration'] as
       | Record<string, unknown>
       | undefined;
@@ -271,8 +277,8 @@ export class S3VectorsProvider implements ResourceProvider {
           vectorBucketName,
           encryptionConfiguration: encryptionConfiguration
             ? {
-                sseType: encryptionConfiguration['SSEType'] as SseType | undefined,
-                kmsKeyArn: encryptionConfiguration['KMSKeyArn'] as string | undefined,
+                sseType: encryptionConfiguration['SseType'] as SseType | undefined,
+                kmsKeyArn: encryptionConfiguration['KmsKeyArn'] as string | undefined,
               }
             : undefined,
           ...(tags && Object.keys(tags).length > 0 ? { tags } : {}),
@@ -383,8 +389,8 @@ export class S3VectorsProvider implements ResourceProvider {
    *
    * Issues `GetVectorBucket` for the bucket name (the physical id) and
    * surfaces `VectorBucketName` and `EncryptionConfiguration` (re-shaping
-   * the camelCase SDK response back to PascalCase CFn property names —
-   * `sseType` → `SSEType`, `kmsKeyArn` → `KMSKeyArn`).
+   * the camelCase SDK response back to the CFn property names —
+   * `sseType` → `SseType`, `kmsKeyArn` → `KmsKeyArn`).
    *
    * Returns `undefined` when the bucket is gone (`NotFoundException` /
    * `NoSuchVectorBucket`).
@@ -415,17 +421,17 @@ export class S3VectorsProvider implements ResourceProvider {
       const enc: Record<string, unknown> = {};
       const sseType = bucket.encryptionConfiguration.sseType;
       if (sseType !== undefined) {
-        enc['SSEType'] = sseType;
+        enc['SseType'] = sseType;
       }
-      // Class 1 guard (docs/provider-development.md § 3b): KMSKeyArn is
-      // KMS-only — only valid when SSEType === 'aws:kms'. AWS will not
+      // Class 1 guard (docs/provider-development.md § 3b): KmsKeyArn is
+      // KMS-only — only valid when SseType === 'aws:kms'. AWS will not
       // return kmsKeyArn for AES256-encrypted buckets, but defend
       // against a future SDK that surfaces an account-default KMS key
       // ARN on AES256 responses (which would round-trip back via
       // `cdkd drift --revert` and AWS would reject as
-      // "KMSKeyArn is only valid when SSEType is aws:kms").
+      // "KmsKeyArn is only valid when SseType is aws:kms").
       if (sseType === 'aws:kms' && bucket.encryptionConfiguration.kmsKeyArn !== undefined) {
-        enc['KMSKeyArn'] = bucket.encryptionConfiguration.kmsKeyArn;
+        enc['KmsKeyArn'] = bucket.encryptionConfiguration.kmsKeyArn;
       }
       if (Object.keys(enc).length > 0) result['EncryptionConfiguration'] = enc;
     }

tests/integration/s3-vectors/lib/s3-vectors-stack.ts

@@ -1,5 +1,6 @@
 import * as cdk from 'aws-cdk-lib';
 import { Construct } from 'constructs';
+import * as kms from 'aws-cdk-lib/aws-kms';
 import * as s3vectors from 'aws-cdk-lib/aws-s3vectors';
 
 export class S3VectorsStack extends cdk.Stack {
@@ -28,14 +29,42 @@ export class S3VectorsStack extends cdk.Stack {
           { key: 'team', value: 'platform' },
         ];
 
+    // Issue #1385: the provider read the encryption sub-keys with the WRONG
+    // CFn spellings (`SSEType` / `KMSKeyArn`), so both lookups were always
+    // `undefined` and CreateVectorBucket silently shipped the account-default
+    // encryption instead of this customer-managed key. `EncryptionConfiguration`
+    // is create-only, so it is held CONSTANT across the CDKD_TEST_UPDATE branch
+    // above (a change would force a replacement, not the Tags in-place update
+    // that phase exercises).
+    // Default key policy (account root) only — deliberately NO
+    // `s3vectors.amazonaws.com` grant. This fixture proves the CONFIGURATION
+    // reaches AWS (CreateVectorBucket / GetVectorBucket both succeed and echo
+    // the key back); it writes no vectors, so it would not catch an
+    // AccessDenied on the actual encrypt path. That is out of scope for #1385,
+    // which is purely about the CFn key spelling never reaching the SDK call.
+    const key = new kms.Key(this, 'VectorBucketKey', {
+      description: 'cdkd s3-vectors integ CMK (issue #1385)',
+      enableKeyRotation: false,
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+    });
+
     const vectorBucket = new s3vectors.CfnVectorBucket(this, 'VectorBucket', {
       vectorBucketName: `${this.stackName}-vector-bucket`.toLowerCase(),
+      encryptionConfiguration: {
+        sseType: 'aws:kms',
+        kmsKeyArn: key.keyArn,
+      },
       tags,
     });
 
     new cdk.CfnOutput(this, 'VectorBucketName', {
       value: vectorBucket.ref,
       description: 'S3 Vector Bucket name',
     });
+
+    new cdk.CfnOutput(this, 'VectorBucketKeyArn', {
+      value: key.keyArn,
+      description: 'CMK the vector bucket must be encrypted with',
+    });
   }
 }

tests/integration/s3-vectors/verify.sh

@@ -107,15 +107,43 @@ if [ -z "${BUCKET_NAME}" ]; then
   exit 1
 fi
 
-# Resolve the bucket ARN — ListTagsForResource is keyed by ARN, not name.
-BUCKET_ARN=$(aws s3vectors get-vector-bucket \
+EXPECTED_KEY_ARN=$(echo "${STATE}" | jq -r '.outputs.VectorBucketKeyArn // empty')
+if [ -z "${EXPECTED_KEY_ARN}" ]; then
+  echo "FAIL: state.outputs.VectorBucketKeyArn missing after deploy" >&2
+  echo "${STATE}" | jq '.outputs'
+  exit 1
+fi
+
+# One GetVectorBucket read serves both the ARN resolution (ListTagsForResource
+# is keyed by ARN, not name) and the #1385 encryption assertion below.
+BUCKET_JSON=$(aws s3vectors get-vector-bucket \
   --vector-bucket-name "${BUCKET_NAME}" --region "${REGION}" \
-  --query 'vectorBucket.vectorBucketArn' --output text 2>/dev/null)
-if [ -z "${BUCKET_ARN}" ] || [ "${BUCKET_ARN}" = "None" ]; then
+  --query 'vectorBucket' --output json)
+BUCKET_ARN=$(echo "${BUCKET_JSON}" | jq -r '.vectorBucketArn // empty')
+if [ -z "${BUCKET_ARN}" ]; then
   echo "FAIL: GetVectorBucket(${BUCKET_NAME}) returned no ARN" >&2
   exit 1
 fi
 
+# --- Assertion: EncryptionConfiguration reached AWS (issue #1385) ----
+# The provider used to read the non-existent CFn keys `SSEType` / `KMSKeyArn`,
+# so both were always undefined and the bucket came up with the account-default
+# AES256 encryption while cdkd reported success. Assert the CMK actually stuck.
+SSE_TYPE=$(echo "${BUCKET_JSON}" | jq -r '.encryptionConfiguration.sseType // empty')
+KMS_KEY_ARN=$(echo "${BUCKET_JSON}" | jq -r '.encryptionConfiguration.kmsKeyArn // empty')
+
+if [ "${SSE_TYPE}" != "aws:kms" ]; then
+  echo "FAIL: encryptionConfiguration.sseType is '${SSE_TYPE}', expected 'aws:kms' (issue #1385 NOT closed)" >&2
+  echo "      raw bucket: ${BUCKET_JSON}" >&2
+  exit 1
+fi
+if [ "${KMS_KEY_ARN}" != "${EXPECTED_KEY_ARN}" ]; then
+  echo "FAIL: encryptionConfiguration.kmsKeyArn is '${KMS_KEY_ARN}', expected '${EXPECTED_KEY_ARN}' (issue #1385 NOT closed)" >&2
+  echo "      raw bucket: ${BUCKET_JSON}" >&2
+  exit 1
+fi
+echo "    OK: VectorBucket encrypted with the requested CMK (SseType/KmsKeyArn reach AWS)"
+
 # --- Assertion: Tags reached AWS via CreateVectorBucket.tags ---------
 TAGS_JSON=$(aws s3vectors list-tags-for-resource \
   --resource-arn "${BUCKET_ARN}" --region "${REGION}" \
@@ -183,5 +211,20 @@ echo "    OK: VectorBucket is gone"
 assert_gone "state file s3://${STATE_BUCKET}/${STATE_KEY} still exists after destroy" aws s3api head-object --bucket "${STATE_BUCKET}" --key "${STATE_KEY}"
 echo "    OK: state file is gone"
 
+# The CMK is NOT an orphan: AWS never hard-deletes a KMS key, so a destroyed
+# `RemovalPolicy.DESTROY` key lands in PendingDeletion (7-day default window)
+# rather than disappearing. Assert that state explicitly so a key left ENABLED
+# (a real leak — the destroy never scheduled it) still fails the run.
+KEY_STATE=$(aws kms describe-key --key-id "${EXPECTED_KEY_ARN}" --region "${REGION}" \
+  --query 'KeyMetadata.KeyState' --output text) || {
+  echo "FAIL: describe-key on ${EXPECTED_KEY_ARN} failed — cannot determine whether the CMK was scheduled for deletion" >&2
+  exit 1
+}
+if [ "${KEY_STATE}" != "PendingDeletion" ]; then
+  echo "FAIL: CMK ${EXPECTED_KEY_ARN} is '${KEY_STATE}' after destroy, expected PendingDeletion" >&2
+  exit 1
+fi
+echo "    OK: CMK scheduled for deletion (PendingDeletion)"
+
 echo ""
-echo "==> s3-vectors test passed (Tags backfill closed + clean destroy)"
+echo "==> s3-vectors test passed (Tags backfill + #1385 CMK encryption + clean destroy)"

tests/unit/provisioning/providers/s3-vectors-provider.test.ts

@@ -82,6 +82,67 @@ describe('S3VectorsProvider', () => {
       });
     });
 
+    it('maps the CFn EncryptionConfiguration spellings (SseType / KmsKeyArn) onto the SDK members (issue #1385)', async () => {
+      // Regression guard: the provider used to read `SSEType` / `KMSKeyArn`,
+      // which the CFn registry schema (and CDK's CfnVectorBucket renderer)
+      // never emit — both lookups were always `undefined`, so a KMS-encrypted
+      // vector bucket silently came up with the account-default encryption.
+      mockSend.mockImplementation((cmd: unknown) => {
+        if (cmd instanceof CreateVectorBucketCommand) {
+          return Promise.resolve({
+            vectorBucketArn: 'arn:aws:s3vectors:us-east-1:0:vector-bucket/kms-vector-bucket',
+          });
+        }
+        return Promise.resolve({});
+      });
+
+      await provider.create('MyVectorBucket', 'AWS::S3Vectors::VectorBucket', {
+        VectorBucketName: 'kms-vector-bucket',
+        EncryptionConfiguration: {
+          SseType: 'aws:kms',
+          KmsKeyArn: 'arn:aws:kms:us-east-1:123456789012:key/abc',
+        },
+      });
+
+      const createCall = mockSend.mock.calls.find(
+        (call: unknown[]) => call[0] instanceof CreateVectorBucketCommand
+      );
+      expect(createCall![0].input).toStrictEqual({
+        vectorBucketName: 'kms-vector-bucket',
+        encryptionConfiguration: {
+          sseType: 'aws:kms',
+          kmsKeyArn: 'arn:aws:kms:us-east-1:123456789012:key/abc',
+        },
+      });
+    });
+
+    it('maps AES256 EncryptionConfiguration with no KmsKeyArn', async () => {
+      mockSend.mockImplementation((cmd: unknown) => {
+        if (cmd instanceof CreateVectorBucketCommand) {
+          return Promise.resolve({
+            vectorBucketArn: 'arn:aws:s3vectors:us-east-1:0:vector-bucket/aes-vector-bucket',
+          });
+        }
+        return Promise.resolve({});
+      });
+
+      await provider.create('MyVectorBucket', 'AWS::S3Vectors::VectorBucket', {
+        VectorBucketName: 'aes-vector-bucket',
+        EncryptionConfiguration: { SseType: 'AES256' },
+      });
+
+      const createCall = mockSend.mock.calls.find(
+        (call: unknown[]) => call[0] instanceof CreateVectorBucketCommand
+      );
+      // toStrictEqual, not toEqual: toEqual ignores undefined-valued keys, so
+      // `kmsKeyArn: undefined` would READ as a pinned absence while checking
+      // nothing. AES256 must never carry a key ARN (AWS rejects it).
+      expect(createCall![0].input).toStrictEqual({
+        vectorBucketName: 'aes-vector-bucket',
+        encryptionConfiguration: { sseType: 'AES256', kmsKeyArn: undefined },
+      });
+    });
+
     it('forwards Tags into CreateVectorBucket as the SDK Record<string,string> shape', async () => {
       mockSend.mockImplementation((cmd: unknown) => {
         if (cmd instanceof CreateVectorBucketCommand) {
@@ -340,8 +401,8 @@ describe('S3VectorsProvider', () => {
           'MyVectorBucket',
           'my-vector-bucket',
           'AWS::S3Vectors::VectorBucket',
-          { EncryptionConfiguration: { SSEType: 'aws:kms' } },
-          { EncryptionConfiguration: { SSEType: 'AES256' } }
+          { EncryptionConfiguration: { SseType: 'aws:kms' } },
+          { EncryptionConfiguration: { SseType: 'AES256' } }
         )
       ).rejects.toThrow(ResourceUpdateNotSupportedError);
       // Must fail BEFORE any AWS call.

tests/unit/provisioning/s3-vectors-provider-readcurrentstate.test.ts

@@ -71,8 +71,8 @@ describe('S3VectorsProvider.readCurrentState', () => {
     expect(result).toEqual({
       VectorBucketName: 'my-vec-bucket',
       EncryptionConfiguration: {
-        SSEType: 'aws:kms',
-        KMSKeyArn: 'arn:aws:kms:us-east-1:123:key/abc',
+        SseType: 'aws:kms',
+        KmsKeyArn: 'arn:aws:kms:us-east-1:123:key/abc',
       },
       Tags: [],
     });