通过AWS CDK部署时如何对密钥执行存在性检查

方法1：用CDK的fromLookup提前校验 #

CDK的kms.Key.fromLookup方法会在 synth 阶段尝试查找指定的KMS密钥，若密钥不存在，直接抛出错误终止流程，避免走到部署环节。

示例代码（TypeScript）：

import * as kms from 'aws-cdk-lib/aws-kms';
import { Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class KeyCheckStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    try {
      // 尝试查找目标密钥
      const targetKey = kms.Key.fromLookup(this, 'TargetKmsKey', {
        keyId: 'your-key-id-or-full-arn',
      });
      console.log(`确认密钥存在：${targetKey.keyArn}`);
      // 后续部署逻辑...
    } catch (err) {
      console.error(`密钥不存在：${(err as Error).message}`);
      throw new Error('缺失必要KMS密钥，部署终止');
    }
  }
}

方法2：自定义资源实时检查 #

如果需要在部署阶段动态验证密钥存在性（比如要根据结果调整部署逻辑），可以用CDK自定义资源调用AWS SDK的describeKey接口。

示例代码（TypeScript）：

import * as cdk from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cr from 'aws-cdk-lib/custom-resources';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class DynamicKeyCheckStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // 编写检查密钥的Lambda函数
    const keyChecker = new lambda.Function(this, 'KeyCheckerFn', {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
        const AWS = require('aws-sdk');
        const kms = new AWS.KMS();

        exports.handler = async (event) => {
          const keyId = event.ResourceProperties.KeyId;
          try {
            await kms.describeKey({ KeyId: keyId }).promise();
            return { Status: 'SUCCESS', Data: { Exists: true } };
          } catch (err) {
            if (err.code === 'NotFoundException') {
              return { Status: 'SUCCESS', Data: { Exists: false } };
            }
            throw err;
          }
        };
      `),
    });

    // 给Lambda赋予描述密钥的权限
    keyChecker.addToRolePolicy(new iam.PolicyStatement({
      actions: ['kms:DescribeKey'],
      resources: ['*'], // 建议限定为目标密钥ARN以提升安全性
    }));

    // 创建自定义资源触发检查
    const keyCheck = new cr.AwsCustomResource(this, 'KeyCheckCr', {
      onCreate: {
        service: 'Lambda',
        action: 'invoke',
        parameters: {
          FunctionName: keyChecker.functionName,
          Payload: JSON.stringify({ ResourceProperties: { KeyId: 'your-key-id-or-arn' } }),
        },
        physicalResourceId: cr.PhysicalResourceId.of(`key-check-${Date.now()}`),
      },
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });

    // 获取检查结果，可用于条件部署
    const keyExists = keyCheck.getResponseField('Payload.Exists');
    new cdk.CfnOutput(this, 'KeyExistsStatus', { value: keyExists });
  }
}

方法3：前置CLI脚本检查 #

在执行cdk deploy前，用AWS CLI命令提前验证密钥存在性，适合集成到CI/CD流水线中：

# 检查密钥是否存在
aws kms describe-key --key-id your-key-id-or-arn > /dev/null 2>&1
if [ $? -ne 0 ]; then
  echo "错误：目标KMS密钥不存在，终止部署"
  exit 1
fi

# 执行CDK部署
cdk deploy

内容的提问来源于stack exchange，提问作者Igor