KMS Alias with RDS or Elasticache causes forced recreation

[autarchprinceps]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform 1.2.3
AWS Provider 4.21.0

Affected Resource(s)

• aws_elasticache_replication_group
• aws_rds_cluster

Terraform Configuration Files

~ kms_key_id = "arn:aws:kms:region:account:key/key_id" -> "arn:aws:kms:region:account:alias/alias_name" # forces replacement

Expected Behavior

The key id is equivalent to the alias and therefore no change is necessary.

Actual Behavior

Database / cache group is completely deleted and then created again.
FYI: For s3 buckets it works correctly with the same alias without forcing changes.

[keruzu]

Same issue, slightly different symptom:

~ resource "aws_dynamodb_table" "my_table_name" {
~ server_side_encryption {
~ kms_key_arn = "arn:aws:kms:us-east-1::key/" -> "arn:aws:kms:us-east-1::alias/"
# (1 unchanged attribute hidden)
}

Error: error updating DynamoDB Table (my_table_name) SSE: LimitExceededException: Subscriber limit exceeded: Encryption mode changes are limited in the 24h window ending at xxxx. After the first 4 change, each subsequent change in the same window can be performed at most once every 21600 seconds