aws - convert key alias to key id before cache lookup

[PratMis]

Closes #8504

[ajkerrigan]

Thanks for this, looks good 👍 . I added a test and made one tweak (comment inline), feedback or alternatives welcome on that.

[PratMis]

Thanks for this, looks good 👍 . I added a test and made one tweak (comment inline), feedback or alternatives welcome on that.

Thanks @ajkerrigan , looks good to me. Sorry, I should have added a test 😄 . Also, the test failure here seems unrelated. Great idea of creating a new flipped dict. I guess it might come handy later

[ajkerrigan]

Thanks for this, looks good +1 . I added a test and made one tweak (comment inline), feedback or alternatives welcome on that.

Thanks @ajkerrigan , looks good to me. Sorry, I should have added a test smile . Also, the test failure here seems unrelated. Great idea of creating a new flipped dict. I guess it might come handy later

Looks like with this change, we avoid some cases where we'd otherwise need to list all aliases. That secrets manager test had 2 list_aliases calls but only needed to use 1.

...but that might mess with cache reuse. Need to do some more testing with this sorry :-/

[PratMis]

Thanks for the feedback and changes @ajkerrigan . Let me get back to you on this. I'll test it in our environment to find out if its breaking something.

[PratMis]

Ok, I went ahead and tested this. The original issue doesn't seem to be happening anymore. When running it against a bunch of accounts, I also didn't see any errors.

[ajkerrigan]

Ok, I went ahead and tested this. The original issue doesn't seem to be happening anymore. When running it against a bunch of accounts, I also didn't see any errors.

That's great, thanks for confirming. I also added a test for that specific cache-related issue. Without the changes in this PR it fails and throws those warnings:

WARNING  custodian.filters:related.py:77 Resource sqs:https://sqs.us-east-1.amazonaws.com/644160558196/test-kms-cache-custom-key
references non existant Key: alias/kms-cache-check  

[PratMis]

Thanks @ajkerrigan, learned something new about testing with cache enabled 😄