(aws-iot-actions): SNS-Topic-Action missing master-key policies #24848
Description
Describe the bug
When creating an SNS topic action with a master-key the action does not work, because it does not have the permission to use the KMS-Key.
Expected Behavior
I would expect the action to work.
Current Behavior
It does not work, because of missing KMS-Key permissions.
Reproduction Steps
# kms_key
sns_topic = aws_sns.Topic(self, 'MyTopic', master_key=kms_key)
aws_iot_alpha.TopicRule(
self,
f'MyTopicRule',
actions=[
iot_actions.SnsTopicAction(
sns_topic,
message_format=iot_actions.SnsActionMessageFormat.RAW,
)
],
error_action=iot_actions.CloudWatchLogsAction(
aws_logs.LogGroup(self, 'ErrorTopicRuleMyAction')
),
sql=iot.IotSql.from_string_as_ver20160323(
f'SELECT * FROM "$aws/events/presence/connected/#"'
),
)Possible Solution
I did not look into the source code yet, but I guess it should be possible to grant the required permissions to the sns topic action role.
The following is a workaround I currently use:
# kms_key
# iam_role
ksm_key.grant_encrypt_decrypt(iam_role)
sns_topic = aws_sns.Topic(self, 'MyTopic', master_key=kms_key)
aws_iot_alpha.TopicRule(
self,
f'MyTopicRule',
actions=[
iot_actions.SnsTopicAction(
sns_topic,
message_format=iot_actions.SnsActionMessageFormat.RAW,
role= iam_role
)
],
error_action=iot_actions.CloudWatchLogsAction(
aws_logs.LogGroup(self, 'ErrorTopicRuleMyAction')
),
sql=iot.IotSql.from_string_as_ver20160323(
f'SELECT * FROM "$aws/events/presence/connected/#"'
),
)Additional Information/Context
No response
CDK CLI Version
2.70
Framework Version
No response
Node.js Version
16.15.0
OS
MacOS
Language
Python
Language Version
3.9
Other information
No response