S3 backend with kms regression

[alex-ikse]

Terraform Version

1.6.0

Terraform Configuration Files

terraform {
  backend "s3" {
    bucket         = "my-state-bucket"
    kms_key_id     = "alias/my-kms-key"
    dynamodb_table = "my-state-bucket-lock"
  }
}

Debug Output

https://gist.github.com/alex-ikse/8cc4fec7464b4386a43d57ff25a5de8b

Expected Behavior

$ terraform init -reconfigure

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Actual Behavior

$ terraform init -reconfigure

Initializing the backend...
╷
│ Error: Invalid KMS Key ID
│ 
│   on remote_state.tf line 4, in terraform:
│    4:     kms_key_id     = "alias/my-kms-key"
│ 
│ Value must be a valid KMS Key ID, got "alias/my-kms-key"

Steps to Reproduce

1. terraform init -reconfigure

Additional Context

No response

References

No response

[alex-ikse]

The problem is with the new validation function here : https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/s3/validate.go#L33-L46
It doesn't handle alias syntax although it was valid before v1.6.0

[iamnotabout]

same issue.
as a workaround we downgraded back to 1.5.7

[andrewhertog]

We get the same error with we try use arn:aws:kms:us-east-1:<account-id>:alias/aws/s3

[andrewhertog]

Took a quick look at the s3 library being used, it supports both alias and arn/alias formats, so I don't know why this is being blocked by terraform? @gdavison made the changes maybe they have context. Here's the PR where the change was made. #33534

[jonmcewen]

@gdavison is there any reason to disallow KMS Key aliases, or can this be fixed?

[andrewhertog]

I've proposed a fix, but I'd like to know first if there was a reason for not allowing KMS aliases

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.