title: terraform and kms key aliases
body: <p>I am using the aws provider and trying to create an aws_workspaces_workspace with encrypted volumes.</p>
  <p>I created an aws_kms_key with an associated alias (aws_kms_alias).</p>
  <p>I specified the key alias (as a string) for volume_encryption_key.
  The resource is created as expected and I can verify in the console that the volumes are encrypted with the specified key.</p>
  <p>My issue is that every time I re-run terraform apply, terraform reports that the aws_workspaces_workspace needs to be replaced because of an update in the key value (from a key id to the alias)</p>
  <p>How can I prevent this form happening?  Is this a bug?  Am I doing something incorrectly?  Some of the relevant code is below.</p>
  <pre><code>resource &quot;aws_workspaces_workspace&quot; &quot;workspace&quot; {
      directory_id = aws_workspaces_directory.ws-ad.id
      bundle_id    = var.bundle_id
      user_name    = var.username
  
      root_volume_encryption_enabled = true
      user_volume_encryption_enabled = true
      volume_encryption_key          = &quot;alias/workspace-volume&quot;
  
      workspace_properties {
          compute_type_name                         = &quot;POWER&quot;
          user_volume_size_gib                      = 80
          root_volume_size_gib                      = 50
          running_mode                              = &quot;AUTO_STOP&quot;
          running_mode_auto_stop_timeout_in_minutes = 60
      }
  }
  
  resource &quot;aws_kms_key&quot; &quot;kms-ws-volume&quot; {
      description             = &quot;Workspace Volume Encryption Key&quot;
      key_usage               = &quot;ENCRYPT_DECRYPT&quot;
      deletion_window_in_days = 30
      is_enabled              = true
  }
  
  resource &quot;aws_kms_alias&quot; &quot;kms-ws-volume-alias&quot; {
      name          = &quot;alias/workspace-volume&quot;
      target_key_id = aws_kms_key.kms-ws-volume.key_id
  }
  </code></pre>
  <p>Here's what terraform apply reports:</p>
  <pre><code>  # aws_workspaces_workspace.workspace[&quot;1&quot;] must be replaced
  -/+ resource &quot;aws_workspaces_workspace&quot; &quot;workspace&quot; {
        ~ computer_name                  = &quot;WSAMZN-T34E23BK&quot; -&gt; (known after apply)
        ~ id                             = &quot;ws-v98b0y17z&quot; -&gt; (known after apply)
        ~ ip_address                     = &quot;10.0.0.45&quot; -&gt; (known after apply)
        ~ state                          = &quot;STOPPED&quot; -&gt; (known after apply)
          tags                           = {
              &quot;Name&quot;    = &quot;workspace-user1-env1&quot;
              &quot;Owner&quot;   = &quot;mario&quot;
              &quot;Profile&quot; = &quot;dev&quot;
              &quot;Stack&quot;   = &quot;env1&quot;
          }
        ~ volume_encryption_key          = &quot;arn:aws:kms:us-west-2:927743275319:key/09de3db9-ecdd-4be1-a781-705fdd0294f9&quot; -&gt; &quot;alias/workspace-volume&quot; # forces replacement
          # (6 unchanged attributes hidden)
  
          # (1 unchanged block hidden)
      }
  </code></pre>