fix(kms): Alias reference incorrectly resolves to underlying Key (#35545)

Because `IAlias` extends `IKey`, `IAlias` inherits the new `keyRef: KeyReference`.

It was originally implemented by referencing the underlying key, but that's wrong: it should reference the alias itself, but using the field names it shares with `IKey`.

In fact, we should have introduced a new interface like `IKeyLike` to do this job, but instead we overloaded `IKey` to behave like a hypothetical `IKeyLike`, and `IKeyRef` now inherits this double duty.

Therefore, we now make the `IKeyRef` implementation of `Alias` behave like a `IKeyLikeRef`, and satisfy the contract using its own fields.

Closes #35543 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/aws-cdk-lib/aws-kms/lib/alias.ts

@@ -69,7 +69,13 @@ abstract class AliasBase extends Resource implements IAlias {
   }
 
   public get keyRef(): KeyReference {
-    return this.aliasTargetKey.keyRef;
+    // Not actually referering to the key: `IKeyRef` here is being used as a
+    // hypothetical `IKeyLikeRef`, and we need to return the Alias values using
+    // the Key interface.
+    return {
+      keyArn: this.aliasArn,
+      keyId: this.keyId,
+    };
   }
 
   /**

packages/aws-cdk-lib/aws-kms/lib/key.ts

@@ -26,6 +26,9 @@ import * as cxapi from '../../cx-api';
 
 /**
  * A KMS Key, either managed by this CDK app, or imported.
+ *
+ * This interface does double duty: it represents an actual KMS keys, but it
+ * also represents things that can behave like KMS keys, like a key alias.
  */
 export interface IKey extends IResource, IKeyRef {
   /**

packages/aws-cdk-lib/aws-kms/test/alias.test.ts

@@ -911,6 +911,19 @@ test('aliasArn should be a valid ARN', () => {
   }, stack));
 });
 
+test('Alias keyRef should reference the Alias, not the underlying key', () => {
+  // GIVEN
+  const app = new App();
+  const stack = new Stack(app, 'Test');
+  const key = new Key(stack, 'Key');
+
+  // WHEN
+  const alias = key.addAlias('alias/foo');
+
+  // THEN
+  expect(alias.keyRef.keyArn).toEqual(alias.aliasArn);
+});
+
 class AliasOutputsConstruct extends Construct {
   constructor(scope: Construct, id: string, key: IKey) {
     super(scope, id);