Fix for aws_kms_info with external/custom key store keys

[PandaWill]

SUMMARY

aws_kms_info raises an exception when used with a KMS key where the source of key material is external.

botocore.errorfactory.UnsupportedOperationException: An error occurred (UnsupportedOperationException) when calling the GetKeyRotationStatus operation: arn:aws:kms:<key_id> origin is EXTERNAL which is not valid for this operation.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

aws_kms_info

ADDITIONAL INFORMATION

The documentation states that these key types are not supported, https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works

Unsupported CMK types. Automatic key rotation is not supported on the following types of CMKs, but you can rotate these CMKs manually.

• Asymmetric CMKs
• CMKs in custom key stores
• CMKs that have imported key material

We don't have to handle the case for asymmetric keys because the KMS end-point just returns false. But we do have to handle the external/custom key store key cases:

$ aws kms get-key-rotation-status --key-id <asymmetric_key_id>
{
    "KeyRotationEnabled": false
}

$ aws kms get-key-rotation-status --key-id <external_key_id>
An error occurred (UnsupportedOperationException) when calling the GetKeyRotationStatus operation: arn:aws:kms:<key_id> origin is EXTERNAL which is not valid for this operation.

Note I haven't added a regression test because aws_kms cannot create KMS keys with external key material.

[tremble]

Hi @PandaWill,

Thanks for your contribution, the change looks solid and I've successfully run it through the integration tests to double check that the standard behaviour isn't broken. I agree that we can't easily add an integration test for this specific case, however please could you add a changelog entry: https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to

[tremble]

Code looks good

Please could you add a changelog entry: https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to

[PandaWill]

I've added the change-log fragment - I hope it's looks okay.

Thanks for the speedy review.

[tremble]

Thanks for your submission. For the future, an alternative would have been to catch the UnsupportedOperationException error.