fix KMS name validation check

.changelog/13000.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+data-source/aws_kms_alias: Fix `name` plan time validation
+```
+
+```release-note:bug
+resource/aws_kms_alias: Fix `name` and `name_prefix` plan time validation
+```

internal/service/kms/alias.go

@@ -36,7 +36,7 @@ func ResourceAlias() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name_prefix"},
-				ValidateFunc:  validName,
+				ValidateFunc:  validNameForResource,
 			},
 
 			"name_prefix": {
@@ -45,7 +45,7 @@ func ResourceAlias() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
-				ValidateFunc:  validName,
+				ValidateFunc:  validNameForResource,
 			},
 
 			"target_key_arn": {

internal/service/kms/alias_data_source.go

@@ -19,7 +19,7 @@ func DataSourceAlias() *schema.Resource {
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validName,
+				ValidateFunc: validNameForDataSource,
 			},
 			"target_key_arn": {
 				Type:     schema.TypeString,

internal/service/kms/validate.go

@@ -19,11 +19,26 @@ func validGrantName(v interface{}, k string) (ws []string, es []error) {
 	return
 }
 
-func validName(v interface{}, k string) (ws []string, es []error) {
+func validNameForDataSource(v interface{}, k string) (ws []string, es []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^(alias\/)[a-zA-Z0-9:/_-]+$`).MatchString(value) {
+
+	if !regexp.MustCompile(`^(alias\/)[a-zA-Z0-9/_-]+$`).MatchString(value) {
+		es = append(es, fmt.Errorf(
+			"%q must begin with 'alias/' and be comprised of only [a-zA-Z0-9/_-]", k))
+	}
+	return
+}
+
+func validNameForResource(v interface{}, k string) (ws []string, es []error) {
+	value := v.(string)
+
+	if regexp.MustCompile(`^(alias\/aws)`).MatchString(value) {
+		es = append(es, fmt.Errorf("%q cannot begin with reserved AWS CMK prefix 'alias/aws'", k))
+	}
+
+	if !regexp.MustCompile(`^(alias\/)[a-zA-Z0-9/_-]+$`).MatchString(value) {
 		es = append(es, fmt.Errorf(
-			"%q must begin with 'alias/' and be comprised of only [a-zA-Z0-9:/_-]", k))
+			"%q must begin with 'alias/' and be comprised of only [a-zA-Z0-9/_-]", k))
 	}
 	return
 }

internal/service/kms/validate_test.go

@@ -35,7 +35,7 @@ func TestValidGrantName(t *testing.T) {
 	}
 }
 
-func TestValidName(t *testing.T) {
+func TestValidNameForDataSource(t *testing.T) {
 	cases := []struct {
 		Value    string
 		ErrCount int
@@ -48,6 +48,45 @@ func TestValidName(t *testing.T) {
 			Value:    "alias/hashicorp",
 			ErrCount: 0,
 		},
+		{
+			Value:    "alias/Service:Test",
+			ErrCount: 1,
+		},
+		{
+			Value:    "hashicorp",
+			ErrCount: 1,
+		},
+		{
+			Value:    "hashicorp/terraform",
+			ErrCount: 1,
+		},
+	}
+
+	for _, tc := range cases {
+		_, errors := validNameForDataSource(tc.Value, "name")
+		if len(errors) != tc.ErrCount {
+			t.Fatalf("AWS KMS Alias Name validation failed: %v", errors)
+		}
+	}
+}
+
+func TestValidNameForResource(t *testing.T) {
+	cases := []struct {
+		Value    string
+		ErrCount int
+	}{
+		{
+			Value:    "alias/hashicorp",
+			ErrCount: 0,
+		},
+		{
+			Value:    "alias/aws/s3",
+			ErrCount: 1,
+		},
+		{
+			Value:    "alias/Service:Test",
+			ErrCount: 1,
+		},
 		{
 			Value:    "hashicorp",
 			ErrCount: 1,
@@ -59,7 +98,7 @@ func TestValidName(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		_, errors := validName(tc.Value, "name")
+		_, errors := validNameForResource(tc.Value, "name")
 		if len(errors) != tc.ErrCount {
 			t.Fatalf("AWS KMS Alias Name validation failed: %v", errors)
 		}