(aws-sns): grantPublish should also grant permission to decrypt master key #18387
Description
What is the problem?
When calling grantPublish on topic method should add permissions to decrypt master key in order to properly send messages.
Reproduction Steps
from aws_cdk import (
aws_sns as sns,
aws_kms as kms,
aws_iam as iam,
core as cdk,
)
class Test(cdk.Stack):
def __init__(self, scope: cdk.Construct, construct_id: str) -> None:
super().__init__(scope, construct_id)
key = kms.Key(self, 'Key')
topic = sns.Topic(self, 'Topic', master_key=key)
topic.grant_publish(
iam.Role(self, 'Role', assumed_by=iam.ServicePrincipal('ec2'))
)
app = cdk.App()
Test(app, 'BUG')
app.synth()What did you expect to happen?
RoleDefaultPolicy5FFB7DAB is generated with enty allowing to encrypt published message.
RoleDefaultPolicy5FFB7DAB:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: sns:Publish
Effect: Allow
Resource:
Ref: TopicBFC7AF6E
- Action:
- kms:Encrypt
- kms:ReEncrypt*
- kms:GenerateDataKey*
Effect: Allow
Resource:
Fn::GetAtt:
- Key961B73FD
- Arn
Version: "2012-10-17"
PolicyName: RoleDefaultPolicy5FFB7DAB
Roles:
- Ref: Role1ABCC5F0
Metadata:
aws:cdk:path: BUG/Role/DefaultPolicy/ResourceWhat actually happened?
RoleDefaultPolicy5FFB7DAB contains a permission to publish messages to topic but that's about it.
RoleDefaultPolicy5FFB7DAB:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: sns:Publish
Effect: Allow
Resource:
Ref: TopicBFC7AF6E
Version: "2012-10-17"
PolicyName: RoleDefaultPolicy5FFB7DAB
Roles:
- Ref: Role1ABCC5F0
Metadata:
aws:cdk:path: BUG/Role/DefaultPolicy/ResourceCDK CLI Version
1.138.0
Framework Version
No response
Node.js Version
14.17.5
OS
MacOs BigSur
Language
Python
Language Version
3.10.1
Other information
It might not be easy to implement this because grantPublish is defined at TopicBase that does not contain reference to masterKey. Question is, can we retrieve such information for TopicBase or for topics that are being imported.