Add note to KMS alias grant methods docs

faridnsh · matboros · Farid Nouri Neshat · commit 17984983c86d · 2025-05-24T20:04:38.000+02:00
Co-authored-by: Matyas Boros &lt;141938325+matboros@users.noreply.github.com&gt;
diff --git a/packages/aws-cdk-lib/aws-kms/lib/alias.ts b/packages/aws-cdk-lib/aws-kms/lib/alias.ts
@@ -188,7 +188,7 @@ export class Alias extends AliasBase {
    * Import an existing KMS Alias defined outside the CDK app, by the alias name. This method should be used
    * instead of 'fromAliasAttributes' when the underlying KMS Key ARN is not available.
    * This Alias will not have a direct reference to the KMS Key, so addAlias method is not supported.
-   * The grant* methods will use the kms:ResourceAliases condition to grant permissions to the specific alias name.
+   * The grant* methods will use the kms:ResourceAliases condition to grant permissions to the specific alias name. They will also only modify the principal policy, not the key resource policy.
    *
    * @param scope The parent creating construct (usually `this`).
    * @param id The construct's name.

Original file line number	Diff line number	Diff line change
`@@ -188,7 +188,7 @@ export class Alias extends AliasBase {`
`188`	`188`	`* Import an existing KMS Alias defined outside the CDK app, by the alias name. This method should be used`
`189`	`189`	`* instead of 'fromAliasAttributes' when the underlying KMS Key ARN is not available.`
`190`	`190`	`* This Alias will not have a direct reference to the KMS Key, so addAlias method is not supported.`
`191`		`- * The grant* methods will use the kms:ResourceAliases condition to grant permissions to the specific alias name.`
	`191`	`+ * The grant* methods will use the kms:ResourceAliases condition to grant permissions to the specific alias name. They will also only modify the principal policy, not the key resource policy.`
`192`	`192`	`*`
`193`	`193`	* @param scope The parent creating construct (usually `this`).
`194`	`194`	`* @param id The construct's name.`