aws-autoscaling: the ability to set an kmsKey for encryption of ebs volumes

Open Beginner friendly
#38,472 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
aws, typescript
Domain
cloud, infrastructure

Research direction

Start in packages/aws-cdk-lib/aws-autoscaling/lib/volume.ts and compare its EBS volume options with packages/aws-cdk-lib/aws-ec2/lib/volume.ts at the referenced line. Add support for the KMS key option in autoscaling volumes and verify that the example can pass kmsKey and produce encrypted EBS volumes.

Written by the indexing model from the issue text.

Description

@aws-cdk/aws-autoscaling feature-request mixins p2
Describe the feature

It looks like that there is no option to set the kmsKey prop for Autoscaling Group volumes. See https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-autoscaling/lib/volume.ts

In the ec2 volume.ts file it is, see https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-ec2/lib/volume.ts#L132

Use Case

to encrypt ebs volumes in autoscaling groups

Proposed Solution

adding the property to the volume.ts file in the autoscaling group module

Other Information

example showing the difference:

import { App, Stack, StackProps } from 'aws-cdk-lib';
import {
  Instance,
  InstanceClass,
  InstanceSize,
  InstanceType,
  MachineImage,
  BlockDeviceVolume as EC2BDV,
  EbsDeviceVolumeType as EC2EVT,
  Vpc,
} from 'aws-cdk-lib/aws-ec2';
import {
  AutoScalingGroup,
  BlockDeviceVolume as ASGBDV,
  EbsDeviceVolumeType as ASGEVT,
} from 'aws-cdk-lib/aws-autoscaling';
import { Key } from 'aws-cdk-lib/aws-kms';

export class ServerStack extends Stack {
  constructor(scope: App, id: string, props: StackProps) {
    super(scope, id, props);

    const vpc = new Vpc(this, 'vpc-id');
    const kmsKey = new Key(this, 'kmsKey', {});

    new AutoScalingGroup(this, 'ASG', {
      instanceType: InstanceType.of(InstanceClass.M7I, InstanceSize.XLARGE),
      machineImage: MachineImage.latestAmazonLinux2023(),
      vpc,
      blockDevices: [
        {
          deviceName: '/dev/sda1',
          volume: ASGBDV.ebs(150, {
            volumeType: ASGEVT.GP3,
            throughput: 250,
            kmsKey: kmsKey, // this property does not exist
          }),
        },
      ],
    });

    new Instance(this, 'EC2', {
      instanceType: InstanceType.of(InstanceClass.M7I, InstanceSize.XLARGE),
      machineImage: MachineImage.latestAmazonLinux2023(),
      vpc,
      blockDevices: [
        {
          deviceName: '/dev/sda1',
          volume: EC2BDV.ebs(150, {
            volumeType: EC2EVT.GP3,
            throughput: 250,
            kmsKey: kmsKey,
          }),
        },
      ],
    });
  }
}
Acknowledgements
  • I may be able to implement this feature request
  • This feature might incur a breaking change
AWS CDK Library version (aws-cdk-lib)

2.263.0

AWS CDK CLI version

2.1134.0

Environment details (OS name and version, etc.)

node 24 on macOS

Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
71

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/aws-cdk

All issues in aws/aws-cdk

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.