EFS : kmsKey issue when using CMK from another account

[Cloudrage]

Bug

Can't create an EFS specifying kmsKey with a CMK created on another account.

When creating & specifying the CMK directly on the account where the EFS is created, it's working.

Reproduction Steps

Here the code used to create the EFS :

    const KmsKey= kms.Key.fromKeyArn(this, 'KmsKey', 'MyKeyArnOrMySsmStringParameterWithMyKeyArn);

    const Efs = new efs.FileSystem(this, 'Efs', {
      vpc: vpc,
      encrypted: true,
      kmsKey: KmsKey,
      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
      throughputMode: efs.ThroughputMode.PROVISIONED,
      provisionedThroughputPerSecond: cdk.Size.mebibytes(100),
      securityGroup: SecurityGroupEfs
    });

Error Log

Here the error :
| CREATE_FAILED | AWS::EFS::FileSystem | Efs (EfsHost2659FEA6) The request was rejected because the specified key could not be found. [error=NotFoundException]

Environment

• CLI Version : aws-cli/1.18.46 Python/3.7.3 / CDK Version: 1.35.0 (build e0810c8)
• Framework Version: npm 6.14.4
• Language : TypeScript

Other

The code is the same when created with a CMK from the other account or not.
But when the CMK is const fromKeyArn; it won't work.

This is 🐛 Bug Report

[rix0rrr]

Is this even possible? Is this not an upstream service problem?

[Cloudrage]

Strange indeed; I've test again to Switch from the CMK in the EFS Account and the other CMK from our SecOps Account and the problem still the same :

A Synth :

  Efs9E8BF36B:
    Type: AWS::EFS::FileSystem
    Properties:
      Encrypted: true
      KmsKeyId:
        Fn::Select:
          - 1
          - Fn::Split:
              - /
              - Fn::Select:
                  - 5
                  - Fn::Split:
                      - ":"
                      - Ref: KmsKeyEC2ParameterParameter
      PerformanceMode: generalPurpose
      ProvisionedThroughputInMibps: 100
      ThroughputMode: provisioned
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain

The way to Get the Key :

    const KmsKeyEC2Parameter = ssm.StringParameter.fromStringParameterAttributes(this, 'KmsKeyEC2Parameter', {parameterName: '/cdk/'+AppName+'/kms/ec2Key/arn'}).stringValue;
    const KmsKeyEC2 = kms.Key.fromKeyArn(this, 'KmsKeyEC2', KmsKeyEC2Parameter);

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.