diff --git a/packages/aws-cdk-lib/aws-kms/lib/key.ts b/packages/aws-cdk-lib/aws-kms/lib/key.ts index f29950b6dc763..ba5d33c2988e9 100644 --- a/packages/aws-cdk-lib/aws-kms/lib/key.ts +++ b/packages/aws-cdk-lib/aws-kms/lib/key.ts @@ -263,7 +263,7 @@ abstract class KeyBase extends Resource implements IKey { const bucketStack = Stack.of(this); const identityStack = Stack.of(grantee.grantPrincipal); - if (FeatureFlags.of(this).isEnabled(cxapi.KMS_CROSS_ACCOUNT_REGION_KMS_KEY_POLICY)) { + if (FeatureFlags.of(this).isEnabled(cxapi.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE)) { // if two compared stacks have the same region, this should return 'false' since it's from the // same region; if two stacks have different region, then compare env.region return bucketStack.region !== identityStack.region && this.env.region !== identityStack.region; @@ -278,7 +278,7 @@ abstract class KeyBase extends Resource implements IKey { const bucketStack = Stack.of(this); const identityStack = Stack.of(grantee.grantPrincipal); - if (FeatureFlags.of(this).isEnabled(cxapi.KMS_CROSS_ACCOUNT_REGION_KMS_KEY_POLICY)) { + if (FeatureFlags.of(this).isEnabled(cxapi.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE)) { // if two compared stacks have the same region, this should return 'false' since it's from the // same region; if two stacks have different region, then compare env.account return bucketStack.account !== identityStack.account && this.env.account !== identityStack.account; diff --git a/packages/aws-cdk-lib/aws-kms/test/key.test.ts b/packages/aws-cdk-lib/aws-kms/test/key.test.ts index 29a9540a90106..3493c31dff3ac 100644 --- a/packages/aws-cdk-lib/aws-kms/test/key.test.ts +++ b/packages/aws-cdk-lib/aws-kms/test/key.test.ts @@ -83,7 +83,7 @@ describe('key policies', () => { }); test('cross region key with iam role grant', () => { - const app = new cdk.App({ context: { [cxapi.KMS_CROSS_ACCOUNT_REGION_KMS_KEY_POLICY]: true } }); + const app = new cdk.App({ context: { [cxapi.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE]: true } }); const stack = new cdk.Stack(app, 'test-stack', { env: { account: '000000000000', region: 'us-west-2' } }); const key = kms.Key.fromKeyArn( stack, @@ -113,7 +113,7 @@ describe('key policies', () => { }); test('cross region key with iam role grant when feature flag is disabled', () => { - const app = new cdk.App({ context: { [cxapi.KMS_CROSS_ACCOUNT_REGION_KMS_KEY_POLICY]: false } }); + const app = new cdk.App({ context: { [cxapi.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE]: false } }); const stack = new cdk.Stack(app, 'test-stack', { env: { account: '000000000000', region: 'us-west-2' } }); const key = kms.Key.fromKeyArn( stack,