aws-cdk kms multi-region key. What constructors use to setup regions?

Question

Using AWS CDK we could create multi-region KMS keys by

• Creating the principal key(pk) with the level 1 constructor CfnKey
• Creating the replica of the principal key using the level 1 constructor CfnReplicaKey, which takes as one of its parameters the pk_arn

Those constructors however do not specify the regions, where I want to make those keys available.

My question is:

What aws-CDK constructor or pattern should I use to make the replicas available in certain regions, using aws-CDK?

Thanks in advance

Answer 1

CfnReplicaKey will be created in the parent stack's region (see a CloudFormation example in the docs).

For the CDK (and CloudFormation), the unit of deployment is [Edit:] the Stack, which is tied to one environment:

Each Stack instance in your AWS CDK app is explicitly or implicitly associated with an environment (env). An environment is the target AWS account and region into which the stack is intended to be deployed.

This logic applies generally to all CDK resources - the account/region is defined at the stack level, not the construct level. Stacks can be replicated across regions and accounts in several ways, including directly in a CDK app:

# replicate the stack in several regions using CDK

app = core.App()

for region in ["us-east-1". "us-west-1", "us-central-1", "eu-west-1"]:
  MyStack(app, "MyStack_" + region, env=Environment(
        region=region,
        account="555599931100"
    ))

Answer 2

That is the case except for DynamoDB replica tables, which can be created in other regions in same account by one stack. Right? @fedonev @robats