cloudformation-kms-alias-collision

Diagnoses and resolves KMS alias collisions in AWS CDK deployments.

Updated Nov 18, 2025

Search Tags:#aws #cloudformation #cdk #kms #deployment failure #alias collision

Ready to run

npx skills add https://github.com/cajias/claude-skills --skill cloudformation-kms-alias-collision

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cloudformation-kms-alias-collision
Source: https://github.com/cajias/claude-skills/tree/main/skills/cloudformation-kms-alias-collision
Command: npx skills add https://github.com/cajias/claude-skills --skill cloudformation-kms-alias-collision

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps fix CloudFormation and CDK deployment failures caused by KMS alias collisions, especially when a stack fails during early validation before a changeset is created.

Core Features & Use Cases

Conflict Diagnosis: Identifies whether a KMS alias already exists and which stack or key likely created it.
Resolution Strategies: Guides you through renaming aliases, importing an existing key, or removing the conflicting alias from another stack.
Deployment Recovery: Helps restore successful CDK deploys when multiple stacks share similar encryption resource patterns.
Use Case: A developer sees an AWS::EarlyValidation::ResourceExistenceCheck error after adding a KMS key to a new stack and uses this Skill to trace the alias conflict and apply a safe fix.

Quick Start

Ask the skill to help diagnose a CDK deployment failure caused by a KMS alias collision and recommend the safest remediation.

Frequently Asked Questions about cloudformation-kms-alias-collision

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why does my CDK deployment fail with an AWS::EarlyValidation::ResourceExistenceCheck error before creating a changeset?▼

Your CDK deployment fails because a KMS alias collision occurs when a new stack attempts to create an alias that already exists. This early validation error happens when multiple stacks share similar encryption resource patterns and overlapping KMS aliases.

How do I fix a KMS alias collision in AWS CloudFormation?▼

To fix a KMS alias collision, you must inspect existing aliases, trace the stack resources that created them, and then safely rename the conflicting alias or import the existing key. This restores successful CDK deploys by resolving the duplicate encryption resource conflict.

What is the best way to resolve KMS alias conflicts in multi-stack CDK deployments?▼

The best way to resolve KMS alias conflicts in multi-stack CDK deployments is to diagnose which stack created the existing alias, then apply a safe remediation strategy like renaming the alias, importing the existing key, or removing the conflicting alias from the other stack.

Can I import an existing KMS key instead of renaming an alias to fix a CloudFormation deployment failure?▼

Yes, you can import an existing KMS key to fix a CloudFormation deployment failure. Importing the existing key allows your new CDK stack to reference the current encryption resource without creating a duplicate alias, restoring successful deployment.

How do I trace which CDK stack created a conflicting KMS alias?▼

You can trace a conflicting KMS alias by performing alias inspection and stack resource tracing across your AWS CDK stacks. This diagnostic process identifies the specific stack or key that created the existing alias causing the deployment failure.

Do I need to remove a KMS alias from one stack to deploy another in CDK?▼

You may need to remove a conflicting KMS alias from one stack to deploy another in CDK. If two stacks share overlapping KMS aliases, removing the duplicate encryption resource from the existing stack resolves the collision and restores deployment.