feat(kms): Allow opting out of "Retain" deletion policy

packages/@aws-cdk/aws-kms/lib/key.ts

@@ -111,6 +111,14 @@ export interface EncryptionKeyProps {
    * The AWS resource tags to associate with the KMS key.
    */
   tags?: Tags;
+
+  /**
+   * Whether the encryption key should be retained when it is removed from the Stack. This is useful when one wants to
+   * retain access to data that was encrypted with a key that is being retired.
+   *
+   * @default true
+   */
+  retainKey?: boolean;
 }
 
 /**
@@ -168,7 +176,9 @@ export class EncryptionKey extends EncryptionKeyBase {
     });
 
     this.keyArn = resource.keyArn;
-    resource.options.deletionPolicy = DeletionPolicy.Retain;
+    resource.options.deletionPolicy = props.retainKey === false
+                                    ? DeletionPolicy.Delete
+                                    : DeletionPolicy.Retain;
   }
 
   /**

packages/@aws-cdk/aws-kms/test/integ.key-sharing.lit.expected.json

@@ -46,7 +46,7 @@
             "Version": "2012-10-17"
           }
         },
-        "DeletionPolicy": "Retain"
+        "DeletionPolicy": "Delete"
       },
       "MyKeyAlias1B45D9DA": {
         "Type": "AWS::KMS::Alias",

packages/@aws-cdk/aws-kms/test/integ.key-sharing.lit.ts

@@ -13,7 +13,7 @@ class KeyStack extends cdk.Stack {
 
   constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
     super(scope, id, props);
-    this.key = new kms.EncryptionKey(this, 'MyKey');
+    this.key = new kms.EncryptionKey(this, 'MyKey', { retainKey: false });
   }
 }
 

packages/@aws-cdk/aws-kms/test/integ.key.expected.json

@@ -55,7 +55,7 @@
           "Version": "2012-10-17"
         }
       },
-      "DeletionPolicy": "Retain"
+      "DeletionPolicy": "Delete"
     },
     "MyKeyAlias1B45D9DA": {
       "Type": "AWS::KMS::Alias",

packages/@aws-cdk/aws-kms/test/integ.key.ts

@@ -6,7 +6,7 @@ const app = new App();
 
 const stack = new Stack(app, `aws-cdk-kms-1`);
 
-const key = new EncryptionKey(stack, 'MyKey');
+const key = new EncryptionKey(stack, 'MyKey', { retainKey: false });
 
 key.addToResourcePolicy(new PolicyStatement()
   .addAllResources()

packages/@aws-cdk/aws-kms/test/test.key.ts

@@ -65,6 +65,66 @@ export = {
     test.done();
   },
 
+  'default with no retention'(test: Test) {
+    const app = new App();
+    const stack = new Stack(app, 'TestStack');
+
+    new EncryptionKey(stack, 'MyKey', { retainKey: false });
+
+    expect(app.synthesizeStack(stack.name)).to(exactlyMatchTemplate({
+      Resources: {
+      MyKey6AB29FA6: {
+        Type: "AWS::KMS::Key",
+        Properties: {
+        KeyPolicy: {
+          Statement: [
+          {
+            Action: [
+            "kms:Create*",
+            "kms:Describe*",
+            "kms:Enable*",
+            "kms:List*",
+            "kms:Put*",
+            "kms:Update*",
+            "kms:Revoke*",
+            "kms:Disable*",
+            "kms:Get*",
+            "kms:Delete*",
+            "kms:ScheduleKeyDeletion",
+            "kms:CancelKeyDeletion"
+            ],
+            Effect: "Allow",
+            Principal: {
+            AWS: {
+              "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                Ref: "AWS::Partition"
+                },
+                ":iam::",
+                {
+                Ref: "AWS::AccountId"
+                },
+                ":root"
+              ]
+              ]
+            }
+            },
+            Resource: "*"
+          }
+          ],
+          Version: "2012-10-17"
+        }
+        },
+        DeletionPolicy: "Delete",
+      }
+      }
+    }));
+    test.done();
+  },
+
   'default with some permission'(test: Test) {
     const app = new App();
     const stack = new Stack(app, 'Test');