cloudformation-kms-alias-collision

Your CDK deployment fails because a KMS alias collision occurs when a new stack attempts to create an alias that already exists. This early validation error happens when multiple stacks share similar encryption resource patterns and overlapping KMS aliases.

To fix a KMS alias collision, you must inspect existing aliases, trace the stack resources that created them, and then safely rename the conflicting alias or import the existing key. This restores successful CDK deploys by resolving the duplicate encryption resource conflict.

The best way to resolve KMS alias conflicts in multi-stack CDK deployments is to diagnose which stack created the existing alias, then apply a safe remediation strategy like renaming the alias, importing the existing key, or removing the conflicting alias from the other stack.

Yes, you can import an existing KMS key to fix a CloudFormation deployment failure. Importing the existing key allows your new CDK stack to reference the current encryption resource without creating a duplicate alias, restoring successful deployment.

You can trace a conflicting KMS alias by performing alias inspection and stack resource tracing across your AWS CDK stacks. This diagnostic process identifies the specific stack or key that created the existing alias causing the deployment failure.

You may need to remove a conflicting KMS alias from one stack to deploy another in CDK. If two stacks share overlapping KMS aliases, removing the duplicate encryption resource from the existing stack resolves the collision and restores deployment.