Issue with Cross Account Access via Alias

[ajmath]

Thanks for sharing this custom resource!

I'm running into an issue when trying access keys by alias:

Received response status [FAILED] from custom resource. Message returned: alias 'arn:aws:kms:us-east-1:12345678890:alias/CustomAMI' does not resolve to a KMS key (RequestId: 2060bcfb-7e59-4e18-9922-d7a032d74d04)

I was able to get it working by referencing the key directly. It appears that the cross account alias isn't coming back from the list-aliases API call that's being made in the lambda.

[mvanholsteijn]

Do you have permission to list the aliases in the other account?

[ajmath]

Wouldn't you need to assume a role in the other account to have the account's alias show up in the list-alias response? I don't have any IAM restrictions on my account that would interfere with this.

[mvanholsteijn]

You are absolutely right. That would be quite a big change to the code. I am short on time, so a fix will take some time.