Skip to content

(app-staging-synthesizer-alpha): Allow using S3 Managed KMS Key for Bucket #28815

@blimmer

Description

@blimmer

Describe the feature

Currently, the AppStagingSythesizer always creates a KMS key to encrypt the staging bucket:

const key = this.createBucketKey();
// Create the bucket once the dependencies have been created
const bucket = new s3.Bucket(this, bucketId, {
bucketName: stagingBucketName,
...(this.autoDeleteStagingAssets ? {
removalPolicy: RemovalPolicy.DESTROY,
autoDeleteObjects: true,
} : {
removalPolicy: RemovalPolicy.RETAIN,
}),
encryption: s3.BucketEncryption.KMS,
encryptionKey: key,
// Many AWS account safety checkers will complain when buckets aren't versioned
versioned: true,
// Many AWS account safety checkers will complain when SSL isn't enforced
enforceSSL: true,
});

It would be nice if we could opt into using the SSE-S3 keys instead.

Use Case

I'd like to start making more frequent use of the AppStagingSynthesizer. However, by forcing the use of a custom KMS key, each app using this synthesizer incurs a $1/month fee for the key.

Proposed Solution

The DefaultStackSynthesizer does not specify an encryption key and, thus, uses the SSE-S3 managed key by default. It feels like AppStagingSynthesizer should do the same thing by default. IMO, the custom KMS key feels like it should be an opt-in behavior for those who want it.

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

CDK version used

2.122.0

Environment details (OS name and version, etc.)

MacOS

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/app-staging-synthesizer-alphaRelated to the @aws-cdk/app-staging-synthesizer-alpha packageeffort/mediumMedium work item – several days of effortfeature-requestA feature should be added or improved.p2

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions