Skip to content

fix(kms): kms key grant methods misidentify region when enclosing stack is different region#29315

Merged
GavinZZ merged 6 commits intomainfrom
yuanhaoz/kms_update
Mar 14, 2024
Merged

fix(kms): kms key grant methods misidentify region when enclosing stack is different region#29315
GavinZZ merged 6 commits intomainfrom
yuanhaoz/kms_update

Conversation

@GavinZZ
Copy link
Copy Markdown
Member

@GavinZZ GavinZZ commented Feb 29, 2024

Issue # (if applicable)

Closes #29308

Reason for this change

This problem is grant() determines the region of a Key using Stack.of(key).region, however the enclosing Stack's region may differ to that of the actual resource. When this happens, the IAM policy generated allows a * resource which is against the least privilege rule.

Description of changes

KMS key already has env value on account and region, use this first. If not exist, use stack account and region.

Description of how you validated changes

New unit test

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team February 29, 2024 18:23
@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Feb 29, 2024
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Feb 29, 2024
aws-cdk-automation
aws-cdk-automation previously requested changes Feb 29, 2024
View reviewed changes
Copy link
Copy Markdown
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@GavinZZ GavinZZ added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Feb 29, 2024
@aws-cdk-automation aws-cdk-automation dismissed their stale review February 29, 2024 19:08

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@GavinZZ
Copy link
Copy Markdown
Member Author

GavinZZ commented Feb 29, 2024

This change could technically be considered as breaking change although very unlikely. After the change, the new IAM policy would have the Resource field set to a specific KMS key instead of * when key.grant is used to a grantee from a different stack in a different region.

Because it originally grants * to Resource in the policy, users could rely on a different KMS key (which is quite unlikely but possible), this change cause issue. Perhaps I should wrap this using feature flag, open to suggestions.

@GavinZZ GavinZZ marked this pull request as ready for review March 4, 2024 17:13
@paulhcsun
Copy link
Copy Markdown
Contributor

paulhcsun commented Mar 8, 2024

We should add this behind a feature flag to avoid any possibility of introducing a breaking change.

@GavinZZ GavinZZ force-pushed the yuanhaoz/kms_update branch from 0c194b7 to 9c79ad7 Compare March 14, 2024 18:59
@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 14, 2024
@GavinZZ GavinZZ force-pushed the yuanhaoz/kms_update branch from 63e5415 to 4867180 Compare March 14, 2024 20:50
@GavinZZ GavinZZ force-pushed the yuanhaoz/kms_update branch from 4867180 to 0cb1ba9 Compare March 14, 2024 20:51
paulhcsun
paulhcsun approved these changes Mar 14, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@paulhcsun paulhcsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

noice

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

aws-cdk-automation commented Mar 14, 2024

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 22e1b47
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Mar 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 14, 2024
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Mar 14, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@GavinZZ GavinZZ merged commit 9076d6e into main Mar 14, 2024
@GavinZZ GavinZZ deleted the yuanhaoz/kms_update branch March 14, 2024 22:17
This was referenced May 23, 2024
Open
Open
@NOUIY NOUIY mentioned this pull request May 30, 2024
Open
@related-issues-bot-for-aws related-issues-bot-for-aws bot mentioned this pull request Aug 11, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aws-cdk-automation aws-cdk-automation aws-cdk-automation left review comments

+1 more reviewer

@paulhcsun paulhcsun paulhcsun approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1 pr-linter/exempt-integ-test The PR linter will not require integ test changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

aws-kms: Key.grant* methods misidentify Key region when enclosing Stack is different region; leads to wildcard resource ARNs

3 participants

@GavinZZ @paulhcsun @aws-cdk-automation