Skip to content

bug: _custom_key_material_ does not seem to work for RSA_2048 #13375

@schoubey-gds

Description

@schoubey-gds

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When I run the following through a provision.sh script executed through docker compose

aws --endpoint-url=http://localhost:4566 kms create-key \
    --region eu-west-2 \
    --key-usage SIGN_VERIFY \
    --key-spec RSA_2048 \
    --tags '[{"TagKey": "_custom_key_material_", ,"TagValue": "<base64 rsa_2048 private key>"}, {"TagKey":"_custom_id_","TagValue":"14122ec4-cdd0-4154-8275-04363c15fbd9"}]'

I get the following error -

localstack | An error occurred (ValidationException) when calling the CreateKey operation: 1 validation error detected: Value <base64 rsa_2048 private key> at 'tags.1.member.tagValue' failed to satisfy constraint: Member must have length less than or equal to 256

I can also see that

key_size = RSA_CRYPTO_KEY_LENGTHS.get(key_spec)
RSA key are not configured to use a key material at all.

Expected Behavior

The key is created with the custom material.

How are you starting LocalStack?

With a docker-compose file

Steps To Reproduce

How are you starting localstack (e.g., bin/localstack command, arguments, or docker-compose.yml)

docker compose -f docker-compose.yml up --build -d --wait

Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)

Executed through a provision script mounted into the container

aws --endpoint-url=http://localhost:4566 kms create-key \
  --region eu-west-2 \
  --key-usage SIGN_VERIFY \
  --key-spec RSA_2048 \
  --tags '[{"TagKey": "_custom_key_material_", ,"TagValue": "<base64 rsa_2048 private key>"}, {"TagKey":"_custom_id_","TagValue":"14122ec4-cdd0-4154-8275-04363c15fbd9"}]'

Environment

- OS: MacOS 15.7.2 
- LocalStack:
  LocalStack version: 
  LocalStack Docker image sha:sha256:c141c72944720c5c56f22eb980e94c9b625ea89251f9e23a417bc0171dc16142
  LocalStack build date: 10th Nov
  LocalStack build git hash:

Anything else?

No response

Metadata

Metadata

Assignees

Labels

aws:kmsAWS Key Management Servicestatus: backlogTriaged but not yet being worked on

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions