getAddress() returns old key about ethers-aws-kms-signer

[rjchow]

You should probably be creating a new signer with a new keyid after rotating keys

[yehjxraymond]

Use a proxy as a permanent identity.

EOA (can be rotated) --> Identity Proxy --> Other smart contracts

*I'm assuming on-chain interaction here.

[yapyuyou]

We are not using the keyids but rather an alias that the new key takes over. Right now the behaviour is that getAddress will still return the old one but the new key will be used when signing.

The signer is only ever instantiated once so isn't the expected behaviour that the returned value from getAddress is consistent with the key used to sign when calling signMessage?

[rjchow]

None of that is the concern of this library - the library instantiates a Ethers Signer given a set of AWS credentials + KMS Key ID, and expects that the Key ID should not change out from under it.

You should be instantiating a new Signer whenever you expect to use a different KMS Key.