kapilt: fwiw, i got a drive by change here to try and fix docker builds in ci or at least get logs.
diff --git a/c7n/resources/kms.py b/c7n/resources/kms.py
index c4d4d85fb..bce35ccb1 100644
--- a/c7n/resources/kms.py
+++ b/c7n/resources/kms.py
@@ -63,12 +63,20 @@ class DescribeKey(DescribeSource):
         return super().get_resources(ids, cache)
 
     def augment(self, resources):
-        client = local_session(self.manager.session_factory).client('kms')
+        aliases = KeyAlias(self.manager.ctx, {}).resources()
+        alias_map = {}
+        for a in aliases:
+            key_id = a['TargetKeyId']
+            alias_map[key_id] = alias_map.get(key_id, []) + [a['AliasName']]
 
+        client = local_session(self.manager.session_factory).client('kms')
         for r in resources:
             try:
-                key_id = r.get('KeyArn', r.get('KeyId'))
-                info = client.describe_key(KeyId=key_id)['KeyMetadata']
+                key_id = r.get('KeyId')
+                key_arn = r.get('KeyArn', key_id)
+                info = client.describe_key(KeyId=key_arn)['KeyMetadata']
+                if key_id in alias_map:
+                    info['AliasNames'] = alias_map[key_id]
                 r.update(info)
             except ClientError as e:
                 if e.response['Error']['Code'] == 'AccessDeniedException':
diff --git a/tools/dev/dockerpkg.py b/tools/dev/dockerpkg.py
index 486a7c937..ac643bf24 100644
--- a/tools/dev/dockerpkg.py
+++ b/tools/dev/dockerpkg.py
@@ -349,7 +349,7 @@ def retry(retry_count, exceptions, func, *args, **kw):
     attempts = 1
     while attempts <= retry_count:
         try:
-            func(*args, **kw)
+            return func(*args, **kw)
         except exceptions:
             log.warn('retrying on %s' % func)
             attempts += 1
@@ -484,7 +484,7 @@ def push_image(client, image_id, image_refs):
     if "HUB_TOKEN" in os.environ and "HUB_USER" in os.environ:
         log.info("docker hub login %s" % os.environ["HUB_USER"])
         result = client.login(os.environ["HUB_USER"], os.environ["HUB_TOKEN"])
-        if result["Status"] != "Login Succeeded":
+        if result.get("Status", "") != "Login Succeeded":
             raise RuntimeError("Docker Login failed %s" % (result,))
 
     for (repo, tag) in image_refs:

include alias name in kms-key for filtering and notifications
**Is your feature request related to a problem? Please describe.**
I'd like the `AliasName` available in the kms-key resource information for more enriched notifications.

**Describe the solution you'd like**
We could do this one of two ways:
1. augment all the resources with the alias info when the resources are queried.  list-aliases is just one additional api call.
2. only pull in alias info if an `alias` filter is used. to use the alias in a notification, we'd need an extra no-op filter to trigger the extra info.

It seems a lot easier and simpler to go with option 1, but I know you've been leaning away from additional api calls and augmentations by default... thoughts? 
diff --git a/tests/data/placebo/test_cross_account_kms/kms.ListAliases_1.json b/tests/data/placebo/test_cross_account_kms/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_cross_account_kms/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_key_rotation/kms.ListAliases_1.json b/tests/data/placebo/test_key_rotation/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_key_rotation/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_key_rotation_set/kms.ListAliases_1.json b/tests/data/placebo/test_key_rotation_set/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_key_rotation_set/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_alias/kms.DescribeKey_1.json b/tests/data/placebo/test_kms_key_alias/kms.DescribeKey_1.json
new file mode 100644
index 000000000..6eb267c8a
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_alias/kms.DescribeKey_1.json
@@ -0,0 +1,27 @@
+{
+    "status_code": 200,
+    "data": {
+        "KeyMetadata": {
+            "AWSAccountId": "644160558196",
+            "KeyId": "f1f33a6b-91aa-4b0a-904c-f2a0378277f0",
+            "Arn": "arn:aws:kms:us-east-1:644160558196:key/f1f33a6b-91aa-4b0a-904c-f2a0378277f0",
+            "CreationDate": {
+                "__class__": "datetime",
+                "year": 2017,
+                "month": 10,
+                "day": 31,
+                "hour": 5,
+                "minute": 2,
+                "second": 54,
+                "microsecond": 335000
+            },
+            "Enabled": true,
+            "Description": "Default master key that protects my DMS replication instance volumes when no other key is defined",
+            "KeyUsage": "ENCRYPT_DECRYPT",
+            "KeyState": "Enabled",
+            "Origin": "AWS_KMS",
+            "KeyManager": "AWS"
+        },
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_alias/kms.ListAliases_1.json b/tests/data/placebo/test_kms_key_alias/kms.ListAliases_1.json
new file mode 100644
index 000000000..7ac7d8dc1
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_alias/kms.ListAliases_1.json
@@ -0,0 +1,14 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [
+            {
+                "AliasName": "alias/aws/dms",
+                "AliasArn": "arn:aws:kms:us-east-1:644160558196:alias/aws/dms",
+                "TargetKeyId": "f1f33a6b-91aa-4b0a-904c-f2a0378277f0"
+            }
+        ],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_alias/kms.ListKeys_1.json b/tests/data/placebo/test_kms_key_alias/kms.ListKeys_1.json
new file mode 100644
index 000000000..b5444d8b7
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_alias/kms.ListKeys_1.json
@@ -0,0 +1,13 @@
+{
+    "status_code": 200,
+    "data": {
+        "Keys": [
+            {
+                "KeyId": "f1f33a6b-91aa-4b0a-904c-f2a0378277f0",
+                "KeyArn": "arn:aws:kms:us-east-1:644160558196:key/f1f33a6b-91aa-4b0a-904c-f2a0378277f0"
+            }
+        ],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_alias/tagging.GetResources_1.json b/tests/data/placebo/test_kms_key_alias/tagging.GetResources_1.json
new file mode 100644
index 000000000..958027559
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_alias/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_remove_tag/kms.ListAliases_1.json b/tests/data/placebo/test_kms_key_remove_tag/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_remove_tag/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_key_tag/kms.ListAliases_1.json b/tests/data/placebo/test_kms_key_tag/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_kms_key_tag/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_remove_matched/kms.ListAliases_1.json b/tests/data/placebo/test_kms_remove_matched/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_kms_remove_matched/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_kms_remove_named/kms.ListAliases_1.json b/tests/data/placebo/test_kms_remove_named/kms.ListAliases_1.json
new file mode 100644
index 000000000..b9488a5aa
--- /dev/null
+++ b/tests/data/placebo/test_kms_remove_named/kms.ListAliases_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "Aliases": [],
+        "Truncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/test_kms.py b/tests/test_kms.py
index b2b2e075a..e0366684b 100644
--- a/tests/test_kms.py
+++ b/tests/test_kms.py
@@ -35,6 +35,28 @@ class KMSTest(BaseTest):
         resources = p.run()
         self.assertEqual(len(resources), 0)
 
+    def test_kms_key_alias_augment(self):
+        session_factory = self.replay_flight_data("test_kms_key_alias")
+        p = self.load_policy(
+            {
+                "name": "kms-key-alias-filter",
+                "resource": "kms-key",
+                "filters": [
+                    {
+                        "type": "value",
+                        "key": "AliasNames",
+                        "op": "in",
+                        "value": "alias/aws/dms",
+                        "value_type": "swap"
+                    }
+                ],
+            },
+            session_factory=session_factory,
+        )
+
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+
     def test_key_rotation(self):
         session_factory = self.replay_flight_data("test_key_rotation")
         p = self.load_policy(

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock vcrpy
apt-get update apt-get install -y gcc python3-dev
3.8
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
apipkg==1.5
appdirs==1.4.4
argcomplete==1.11.1
attrs==19.3.0
aws-xray-sdk==2.6.0
bleach==3.1.5
boto3==1.14.8
botocore==1.17.8
-e git+https://github.com/cloud-custodian/cloud-custodian.git@0b7d44c5d261b831ac9bc44a07fd10658405362e#egg=c7n
certifi==2020.6.20
cffi==1.14.0
chardet==3.0.4
coverage==5.1
cryptography==2.9.2
distlib==0.3.0
docutils==0.15.2
exceptiongroup==1.2.2
execnet==1.7.1
filelock==3.0.12
flake8==3.8.3
future==0.18.2
idna==2.9
importlib-metadata==1.6.1
iniconfig==2.1.0
jeepney==0.4.3
jmespath==0.10.0
jsonpatch==1.26
jsonpickle==1.4.1
jsonpointer==2.0
jsonschema==3.2.0
keyring==21.2.1
mccabe==0.6.1
mock==4.0.2
more-itertools==8.4.0
multidict==4.7.6
packaging==20.4
pkginfo==1.5.0.1
placebo==0.9.0
pluggy==1.5.0
psutil==5.7.0
py==1.8.2
pycodestyle==2.6.0
pycparser==2.20
pyflakes==2.2.0
Pygments==2.6.1
pyparsing==2.4.7
pyrsistent==0.16.0
pytest==8.3.5
pytest-cov==2.10.0
pytest-forked==1.1.3
pytest-mock==3.14.0
pytest-sugar==0.9.3
pytest-xdist==1.32.0
python-dateutil==2.8.1
PyYAML==5.3.1
readme-renderer==26.0
requests==2.24.0
requests-toolbelt==0.9.1
s3transfer==0.3.3
SecretStorage==3.1.2
six==1.15.0
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.1
tomli==2.2.1
tox==3.15.2
tqdm==4.46.1
twine==3.1.1
urllib3==1.25.9
vcrpy==4.0.2
virtualenv==20.0.24
wcwidth==0.2.4
webencodings==0.5.1
wrapt==1.12.1
yarl==1.4.2
zipp==3.1.0

name: cloud-custodian
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=24.2=py38h06a4308_0
  - python=3.8.20=he870216_0
  - readline=8.2=h5eee18b_0
  - setuptools=75.1.0=py38h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.44.0=py38h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - apipkg==1.5
      - appdirs==1.4.4
      - argcomplete==1.11.1
      - attrs==19.3.0
      - aws-xray-sdk==2.6.0
      - bleach==3.1.5
      - boto3==1.14.8
      - botocore==1.17.8
      - c7n==0.9.4
      - certifi==2020.6.20
      - cffi==1.14.0
      - chardet==3.0.4
      - coverage==5.1
      - cryptography==2.9.2
      - distlib==0.3.0
      - docutils==0.15.2
      - exceptiongroup==1.2.2
      - execnet==1.7.1
      - filelock==3.0.12
      - flake8==3.8.3
      - future==0.18.2
      - idna==2.9
      - importlib-metadata==1.6.1
      - iniconfig==2.1.0
      - jeepney==0.4.3
      - jmespath==0.10.0
      - jsonpatch==1.26
      - jsonpickle==1.4.1
      - jsonpointer==2.0
      - jsonschema==3.2.0
      - keyring==21.2.1
      - mccabe==0.6.1
      - mock==4.0.2
      - more-itertools==8.4.0
      - multidict==4.7.6
      - packaging==20.4
      - pkginfo==1.5.0.1
      - placebo==0.9.0
      - pluggy==1.5.0
      - psutil==5.7.0
      - py==1.8.2
      - pycodestyle==2.6.0
      - pycparser==2.20
      - pyflakes==2.2.0
      - pygments==2.6.1
      - pyparsing==2.4.7
      - pyrsistent==0.16.0
      - pytest==8.3.5
      - pytest-cov==2.10.0
      - pytest-forked==1.1.3
      - pytest-mock==3.14.0
      - pytest-sugar==0.9.3
      - pytest-xdist==1.32.0
      - python-dateutil==2.8.1
      - pyyaml==5.3.1
      - readme-renderer==26.0
      - requests==2.24.0
      - requests-toolbelt==0.9.1
      - s3transfer==0.3.3
      - secretstorage==3.1.2
      - six==1.15.0
      - tabulate==0.8.7
      - termcolor==1.1.0
      - toml==0.10.1
      - tomli==2.2.1
      - tox==3.15.2
      - tqdm==4.46.1
      - twine==3.1.1
      - urllib3==1.25.9
      - vcrpy==4.0.2
      - virtualenv==20.0.24
      - wcwidth==0.2.4
      - webencodings==0.5.1
      - wrapt==1.12.1
      - yarl==1.4.2
      - zipp==3.1.0
prefix: /opt/conda/envs/cloud-custodian

tests/test_kms.py::KMSTest::test_kms_key_alias_augment
tests/test_kms.py::KMSTest::test_key_rotation tests/test_kms.py::KMSTest::test_kms_grant tests/test_kms.py::KMSTest::test_kms_remove_matched tests/test_kms.py::KMSTest::test_kms_remove_named tests/test_kms.py::KMSTest::test_set_key_rotation tests/test_kms.py::KMSTagging::test_kms_key_related tests/test_kms.py::KMSTagging::test_kms_key_remove_tag tests/test_kms.py::KMSTagging::test_kms_key_tag tests/test_kms.py::KMSTagging::test_kms_post_finding
tools/dev/dockerpkg.py c7n/resources/kms.py
tools/dev/dockerpkg.py c7n/resources/kms.py