8000 fix(events-targets): kinesis Stream target with Customer-Managed KMS … · aws/aws-cdk@58dfda0 · GitHub
[go: up one dir, main page]
Skip to content

Commit 58dfda0

Browse files
xazhaoxazhao
authored
fix(events-targets): kinesis Stream target with Customer-Managed KMS key causes EventBridge FailedInvocations (#31836)
### Issue # (if applicable) Closes #10996. ### Reason for this change When a Kinesis Stream is encrypted with a custom managed KMS key, CDK will generate a KMS key for the Kinesis Stream. ``` stream = new kinesis.Stream(stack, 'MyStream', { encryption: kinesis.StreamEncryption.KMS, }); ``` If it is used as a events target, CDK will provide permissions to the role of target so it can write to the kinesis stream: ``` { Action: ['kinesis:PutRecord', 'kinesis:PutRecords'], Effect: 'Allow', Resource: streamArn, } ``` If the kinesis is not encrypted with the customer managed kms key, these permissions will be sufficient. However, since the kinesis is encrypted with the the customer managed kms key, the invocation will fail because events doesn't have the permissions to the KMS key. Actually there's already `grantWrite()` method to grant sufficient permissions in this case. When a customer managed KMS key is used, it will generate extra policies for the key. We should use it. https://github.com/aws/aws-cdk/blob/366b4927c50168113dd4057f6255ab6c76278135/packages/aws-cdk-lib/aws-kinesis/lib/stream.ts#L355 Difference: these permissions will be added to the event ``` { Action: ['kinesis:ListShards(new permission)', 'kinesis:PutRecord', 'kinesis:PutRecords'], Effect: 'Allow', Resource: streamArn, } ``` these permissions will be added to the event if the target kinesis stream is using a customer managed KMS key ``` { Action: ['kms:Encrypt', 'kms:ReEncrypt*', 'kms:GenerateDataKey*'], Effect: 'Allow', Resource: streamKeyArn, }, ``` ### Description of changes Use the existing `grantWrite()` method instead of manipulating IAM policies directly. ### Description of how you validated changes unit tests/integration tests ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 2e691b6 commit 58dfda0

24 files changed

+846
-22
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/KinesisKmsDefaultTestDeployAssertF9D5974E.assets.json

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/KinesisKmsDefaultTestDeployAssertF9D5974E.template.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/aws-cdk-kinesis-event-target.assets.json

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/aws-cdk-kinesis-event-target.template.json

Lines changed: 180 additions & 0 deletions
BD49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
{
2+
"Resources": {
3+
"MyStreamKey76F3300E": {
4+
"Type": "AWS::KMS::Key",
5+
"Properties": {
6+
"Description": "Created by aws-cdk-kinesis-event-target/MyStream",
7+
"KeyPolicy": {
8+
"Statement": [
9+
{
10+
"Action": "kms:*",
11+
"Effect": "Allow",
12+
"Principal": {
13+
"AWS": {
14+
"Fn::Join": [
15+
"",
16+
[
17+
"arn:",
18+
{
19+
"Ref": "AWS::Partition"
20+
},
21+
":iam::",
22+
{
23+
"Ref": "AWS::AccountId"
24+
},
25+
":root"
26+
]
27+
]
28+
}
29+
},
30+
"Resource": "*"
31+
}
32+
],
33+
"Version": "2012-10-17"
34+
}
35+
},
36+
"UpdateReplacePolicy": "Retain",
37+
"DeletionPolicy": "Retain"
38+
},
39+
"MyStream5C050E93": {
40+
"Type": "AWS::Kinesis::Stream",
41+
"Properties": {
42+
"RetentionPeriodHours": 24,
43+
"ShardCount": 1,
44+
"StreamEncryption": {
45+
"EncryptionType": "KMS",
46+
"KeyId": {
47+
"Fn::GetAtt": [
48+
"MyStreamKey76F3300E",
49+
"Arn"
50+
]
51+
}
52+
}
53+
},
54+
"UpdateReplacePolicy": "Retain",
55+
"DeletionPolicy": "Retain"
56+
},
57+
"MyStreamEventsRole5B6CC6AF": {
58+
"Type": "AWS::IAM::Role",
59+
"Properties": {
60+
"AssumeRolePolicyDocument": {
61+
"Statement": [
62+
{
63+
"Action": "sts:AssumeRole",
64+
"Effect": "Allow",
65+
"Principal": {
66+
"Service": "events.amazonaws.com"
67+
}
68+
}
69+
],
70+
"Version": "2012-10-17"
71+
}
72+
}
73+
},
74+
"MyStreamEventsRoleDefaultPolicy2089B49E": {
75+
"Type": "AWS::IAM::Policy",
76+
"Properties": {
77+
"PolicyDocument": {
78+
"Statement": [
79+
{
80+
"Action": [
81+
"kinesis:ListShards",
82+
"kinesis:PutRecord",
83+
"kinesis:PutRecords"
84+
],
85+
"Effect": "Allow",
86+
"Resource": {
87+
"Fn::GetAtt": [
88+
"MyStream5C050E93",
89+
"Arn"
90+
]
91+
}
92+
},
93+
{
94+
"Action": [
95+
"kms:Encrypt",
96+
"kms:GenerateDataKey*",
97+
"kms:ReEncrypt*"
98+
],
99+
"Effect": "Allow",
100+
"Resource": {
101+
"Fn::GetAtt": [
102+
"MyStreamKey76F3300E",
103+
"Arn"
104+
]
105+
}
106+
}
107+
],
108+
"Version": "2012-10-17"
109+
},
110+
"PolicyName": "MyStreamEventsRoleDefaultPolicy2089B49E",
111+
"Roles": [
112+
{
113+
"Ref": "MyStreamEventsRole5B6CC6AF"
114+
}
115+
]
116+
}
117+
},
118+
"EveryMinute2BBCEA8F": {
119+
"Type": "AWS::Events::Rule",
120+
"Properties": {
121+
"ScheduleExpression": "rate(1 minute)",
122+
"State": "ENABLED",
123+
"Targets": [
124+
{
125+
"Arn": {
126+
"Fn::GetAtt": [
127+
"MyStream5C050E93",
128+
"Arn"
129+
]
130+
},
131+
"Id": "Target0",
132+
"KinesisParameters": {
133+
"PartitionKeyPath": "$.id"
134+
},
135+
"RoleArn": {
136+
"Fn::GetAtt": [
137+
"MyStreamEventsRole5B6CC6AF",
138+
"Arn"
139+
]
140+
}
141+
}
142+
]
143+
}
144+
}
145+
},
146+
"Parameters": {
147+
"BootstrapVersion": {
148+
"Type": "AWS::SSM::Parameter::Value<String>",
149+
"Default": "/cdk-bootstrap/hnb659fds/version",
150+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
151+
}
152+
},
153+
"Rules": {
154+
"CheckBootstrapVersion": {
155+
"Assertions": [
156+
{
157+
"Assert": {
158+
"Fn::Not": [
159+
{
160+
"Fn::Contains": [
161+
[
162+
"1",
163+
"2",
164+
"3",
165+
"4",
166+
"5"
167+
],
168+
{
169+
"Ref": "BootstrapVersion"
170+
}
171+
]
172+
}
173+
]
174+
},
175+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
176+
}
177+
]
178+
}
179+
}
180+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/kinesis/integ.kinesis-stream-customer-key.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
0