feat(autoscaling): kmsKey for EBS block devices - #38497
Open
vishwakt wants to merge 1 commit into
Open
Conversation
The autoscaling EbsDeviceOptions had no kmsKey property, so an Auto Scaling group could only encrypt block devices with the default aws/ebs key, while the equivalent ec2 interface has supported a customer managed key for some time. Adds kmsKey to the autoscaling EbsDeviceOptions. Block devices are passed straight to the internal ec2.LaunchTemplate, which already renders KmsKeyId, so no additional rendering is needed on the launch template path. EbsDeviceProps now also extends EbsDeviceOptions, matching the ec2 struct hierarchy, so that encrypted and kmsKey are part of the type rather than only present at runtime. Launch configurations have no KmsKeyId property on block devices, so setting kmsKey without the @aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig feature flag now raises a validation error rather than silently encrypting with the default key. Closes aws#38472.
github-actions
Bot
added
the
beginning-contributor
github-actions
Bot
added
feature-request
aws-cdk-automation
added
the
pr/needs-further-review
aws-cdk-automation
temporarily deployed
to
automation
August 5, 2026 05:35 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
aws-cdk-automation
temporarily deployed
to
automation
August 5, 2026 05:36 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
aws-cdk-automation
added
the
pr/needs-community-review
aws-cdk-automation
temporarily deployed
to
automation
August 5, 2026 06:04 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
aws-cdk-automation
temporarily deployed
to
automation
August 5, 2026 06:04 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #38472.
Reason for this change
aws-autoscaling'sEbsDeviceOptionshas nokmsKey, so an ASG can only encrypt block devices with the defaultaws/ebskey. Theaws-ec2equivalent has supported a customer managed key for some time.Description of changes
kmsKey?: IKeyon the autoscalingEbsDeviceOptions.blockDevicesare passed to the internalec2.LaunchTemplate, whoseebs-utilalready rendersKmsKeyId, so no new rendering code is needed.EbsDevicePropsnow extendsEbsDeviceOptionsas well asEbsDeviceSnapshotOptions, matching theaws-ec2hierarchy. Previouslyencryptedreached the template at runtime without being on the type. Additive,yarn compatpasses.KmsKeyIdon block devices, so settingkmsKeywithout the@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfigfeature flag now throws instead of silently encrypting with the default key.Describe any new or updated permissions being added
None. The key policy must allow the Auto Scaling service to use the key; this is noted in the README and the property docs.
Description of how you validated changes
Three unit tests:
KmsKeyIdrenders on the launch template,KmsKeyIdis absent whenkmsKeyis unset, and the launch-configuration path throws. All 203 autoscaling tests pass. New integ testinteg.asg-block-device-kms-keywith snapshot generated by integ-runner in dry-run mode.yarn build,yarn compat, eslint and Rosetta are clean.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license