Skip to content

Commit

Permalink
fix(aws-kms): Incomplete KMS Resource Policy Permissions (aws#3459)
Browse files Browse the repository at this point in the history 
Fixes aws#3458 where incomplete default resource policy for root account principal was generated and requiring a workaround.

See issue aws#3458 for the complete reference.
  • Loading branch information
Yandy Ramirez authored and Elad Ben-Israel committed Jul 30, 2019
1 parent 334261d commit 1280071
Show file tree
Hide file tree
Showing 27 changed files with 83 additions and 41 deletions.
3 changes: 2 additions & 1 deletion ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion ...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-pipeline.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-alexa-deploy.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-cfn.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-events.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-s3-deploy.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion ...s/@aws-cdk/aws-events-targets/test/codepipeline/integ.pipeline-event-target.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-glue/test/integ.table.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
15 changes: 10 additions & 5 deletions packages/@aws-cdk/aws-glue/test/test.table.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -338,7 +338,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -470,7 +471,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -678,7 +680,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -791,7 +794,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -906,7 +910,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down
15 changes: 10 additions & 5 deletions packages/@aws-cdk/aws-kinesis/test/test.stream.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down Expand Up @@ -215,7 +216,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down Expand Up @@ -298,7 +300,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down Expand Up @@ -435,7 +438,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down Expand Up @@ -580,7 +584,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-kms/lib/key.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,8 @@ export class Key extends KeyBase {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
];

this.addToResourcePolicy(new PolicyStatement({
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-kms/test/integ.key-sharing.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-kms/test/integ.key.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
14 changes: 9 additions & 5 deletions packages/@aws-cdk/aws-kms/test/test.key.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -104,7 +105,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -183,7 +185,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -277,7 +280,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -341,7 +345,7 @@ export = {
// This one is there by default
{
// tslint:disable-next-line:max-line-length
Action: [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ],
Action: [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion", "kms:GenerateDataKey" ],
Effect: "Allow",
Principal: { AWS: { "Fn::Join": [ "", [ "arn:", { Ref: "AWS::Partition" }, ":iam::", { Ref: "AWS::AccountId" }, ":root" ] ] } },
Resource: "*"
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-rds/test/integ.cluster.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -371,7 +371,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-s3-notifications/test/queue.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,8 @@ test('if the queue is encrypted with a custom kms key, the key resource policy i
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-s3-notifications/test/sqs/integ.bucket-notifications.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-s3/test/integ.bucket.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
8 changes: 5 additions & 3 deletions packages/@aws-cdk/aws-s3/test/test.bucket.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down Expand Up @@ -828,7 +829,7 @@ export = {
"Statement": [
{
"Action": ["kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*",
"kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion"],
"kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion", "kms:GenerateDataKey"],
"Effect": "Allow",
"Principal": {
"AWS": {
Expand Down Expand Up @@ -882,7 +883,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
6 changes: 4 additions & 2 deletions packages/@aws-cdk/aws-secretsmanager/test/test.secret.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down Expand Up @@ -204,7 +205,8 @@ export = {
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
Effect: "Allow",
Principal: {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-ses/test/integ.receipt.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,8 @@
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
"kms:CancelKeyDeletion",
"kms:GenerateDataKey"
],
"Effect": "Allow",
"Principal": {
Expand Down
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-ses/test/test.receipt-rule-action.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -310,7 +310,8 @@ export = {
'kms:Get*',
'kms:Delete*',
'kms:ScheduleKeyDeletion',
'kms:CancelKeyDeletion'
'kms:CancelKeyDeletion',
"kms:GenerateDataKey"
],
Effect: 'Allow',
Principal: {
Expand Down
Loading

0 comments on commit 1280071

Please sign in to comment.