Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(kms): kms key grant methods misidentify region when enclosing stack is different region #29315

Merged
merged 6 commits into from
Mar 14, 2024

Conversation

GavinZZ
Copy link
Contributor

@GavinZZ GavinZZ commented Feb 29, 2024

Issue # (if applicable)

Closes #29308

Reason for this change

This problem is grant() determines the region of a Key using Stack.of(key).region, however the enclosing Stack's region may differ to that of the actual resource. When this happens, the IAM policy generated allows a * resource which is against the least privilege rule.

Description of changes

KMS key already has env value on account and region, use this first. If not exist, use stack account and region.

Description of how you validated changes

New unit test

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team February 29, 2024 18:23
@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Feb 29, 2024
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Feb 29, 2024
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@GavinZZ GavinZZ added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Feb 29, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review February 29, 2024 19:08

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@GavinZZ
Copy link
Contributor Author

GavinZZ commented Feb 29, 2024

This change could technically be considered as breaking change although very unlikely. After the change, the new IAM policy would have the Resource field set to a specific KMS key instead of * when key.grant is used to a grantee from a different stack in a different region.

Because it originally grants * to Resource in the policy, users could rely on a different KMS key (which is quite unlikely but possible), this change cause issue. Perhaps I should wrap this using feature flag, open to suggestions.

@GavinZZ GavinZZ marked this pull request as ready for review March 4, 2024 17:13
@paulhcsun
Copy link
Contributor

We should add this behind a feature flag to avoid any possibility of introducing a breaking change.

@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 14, 2024
Copy link
Contributor

@paulhcsun paulhcsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

noice

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 22e1b47
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Copy link
Contributor

mergify bot commented Mar 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 14, 2024
Copy link
Contributor

mergify bot commented Mar 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@GavinZZ GavinZZ merged commit 9076d6e into main Mar 14, 2024
14 of 16 checks passed
@GavinZZ GavinZZ deleted the yuanhaoz/kms_update branch March 14, 2024 22:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1 pr-linter/exempt-integ-test The PR linter will not require integ test changes
Projects
None yet
3 participants