feat: support KEY_AGREEMENT for keyUsage

packages/@aws-cdk-testing/framework-integ/test/aws-kms/test/integ.key-key-agreement.js.snapshot/aws-cdk-kms-key-agreement.template.json

@@ -0,0 +1,75 @@
+{
+ "Resources": {
+  "MyKeyAgreementKey1B696107": {
+   "Type": "AWS::KMS::Key",
+   "Properties": {
+    "KeyPolicy": {
+     "Statement": [
+      {
+       "Action": "kms:*",
+       "Effect": "Allow",
+       "Principal": {
+        "AWS": {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":iam::",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":root"
+          ]
+         ]
+        }
+       },
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "KeySpec": "ECC_NIST_P256",
+    "KeyUsage": "KEY_AGREEMENT"
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete"
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}

packages/@aws-cdk-testing/framework-integ/test/aws-kms/test/integ.key-key-agreement.ts

@@ -0,0 +1,19 @@
+import { App, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { Key, KeySpec, KeyUsage } from 'aws-cdk-lib/aws-kms';
+
+const app = new App();
+
+const stack = new Stack(app, 'aws-cdk-kms-key-agreement');
+
+new Key(stack, 'MyKeyAgreementKey', {
+  removalPolicy: RemovalPolicy.DESTROY,
+  keyUsage: KeyUsage.KEY_AGREEMENT,
+  keySpec: KeySpec.ECC_NIST_P256,
+});
+
+new IntegTest(app, 'KeyAgreementIntegTest', {
+  testCases: [
+    stack,
+  ],
+});

packages/aws-cdk-lib/aws-kms/lib/key.ts

@@ -404,6 +404,11 @@ export enum KeyUsage {
    * Generating and verifying MACs
    */
   GENERATE_VERIFY_MAC = 'GENERATE_VERIFY_MAC',
+
+  /**
+   * Deriving shared secrets
+   */
+  KEY_AGREEMENT = 'KEY_AGREEMENT',
 }
 
 /**
@@ -715,6 +720,18 @@ export class Key extends KeyBase {
         KeySpec.SYMMETRIC_DEFAULT,
         KeySpec.SM2,
       ],
+      [KeyUsage.KEY_AGREEMENT]: [
+        KeySpec.SYMMETRIC_DEFAULT,
+        KeySpec.RSA_2048,
+        KeySpec.RSA_3072,
+        KeySpec.RSA_4096,
+        KeySpec.ECC_SECG_P256K1,
+        KeySpec.HMAC_224,
+        KeySpec.HMAC_256,
+        KeySpec.HMAC_384,
+        KeySpec.HMAC_512,
+        KeySpec.SM2,
+      ],
     };
     const keySpec = props.keySpec ?? KeySpec.SYMMETRIC_DEFAULT;
     const keyUsage = props.keyUsage ?? KeyUsage.ENCRYPT_DECRYPT;

packages/aws-cdk-lib/aws-kms/test/key.test.ts

@@ -1321,6 +1321,18 @@ function generateInvalidKeySpecKeyUsageCombinations() {
       KeySpec.SYMMETRIC_DEFAULT,
       KeySpec.SM2,
     ],
+    [KeyUsage.KEY_AGREEMENT]: [
+      KeySpec.SYMMETRIC_DEFAULT,
+      KeySpec.RSA_2048,
+      KeySpec.RSA_3072,
+      KeySpec.RSA_4096,
+      KeySpec.ECC_SECG_P256K1,
+      KeySpec.HMAC_224,
+      KeySpec.HMAC_256,
+      KeySpec.HMAC_384,
+      KeySpec.HMAC_512,
+      KeySpec.SM2,
+    ],
   };
   const testCases: { keySpec: KeySpec; keyUsage: KeyUsage; toString: () => string }[] = [];
   for (const keySpec in KeySpec) {