Support for AWS KMS Aliases was requested in #381 and implemented in #415. We tried to switch to aliases in the creation_rules, but noticed that the alias' ARN is being stored in encrypted files instead of the key's ARN.

If an alias is deleted or reassigned to another key, it's impossible to find out which KMS Key was actually used.

The EncryptOutput returned by KMS.Encrypt contains the Key Id¹ that was used during encryption and that is what should be stored in the encrypted file.

¹ I'm not sure if this is just the Id or the ARN. See https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html#API_Encrypt_ResponseSyntax (including the examples)