What is the problem?
When calling grantPublish on topic method should add permissions to decrypt master key in order to properly send messages.
Reproduction Steps
from aws_cdk import (
aws_sns as sns,
aws_kms as kms,
aws_iam as iam,
core as cdk,
)
class Test(cdk.Stack):
def __init__(self, scope: cdk.Construct, construct_id: str) -> None:
super().__init__(scope, construct_id)
key = kms.Key(self, 'Key')
topic = sns.Topic(self, 'Topic', master_key=key)
topic.grant_publish(
iam.Role(self, 'Role', assumed_by=iam.ServicePrincipal('ec2'))
)
app = cdk.App()
Test(app, 'BUG')
app.synth()What did you expect to happen?
RoleDefaultPolicy5FFB7DAB is generated with enty allowing to encrypt published message.
RoleDefaultPolicy5FFB7DAB:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: sns:Publish
Effect: Allow
Resource:
Ref: TopicBFC7AF6E
- Action:
- kms:Encrypt
- kms:ReEncrypt*
- kms:GenerateDataKey*
Effect: Allow
Resource:
Fn::GetAtt:
- Key961B73FD
- Arn
Version: "2012-10-17"
PolicyName: RoleDefaultPolicy5FFB7DAB
Roles:
- Ref: Role1ABCC5F0
Metadata:
aws:cdk:path: BUG/Role/DefaultPolicy/ResourceWhat actually happened?
RoleDefaultPolicy5FFB7DAB contains a permission to publish messages to topic but that's about it.
RoleDefaultPolicy5FFB7DAB:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: sns:Publish
Effect: Allow
Resource:
Ref: TopicBFC7AF6E
Version: "2012-10-17"
PolicyName: RoleDefaultPolicy5FFB7DAB
Roles:
- Ref: Role1ABCC5F0
Metadata:
aws:cdk:path: BUG/Role/DefaultPolicy/ResourceCDK CLI Version
1.138.0
Framework Version
No response
Node.js Version
14.17.5
OS
MacOs BigSur
Language
Python
Language Version
3.10.1
Other information
It might not be easy to implement this because grantPublish is defined at TopicBase that does not contain reference to masterKey. Question is, can we retrieve such information for TopicBase or for topics that are being imported.
What is the problem?
When calling
grantPublishon topic method should add permissions to decrypt master key in order to properly send messages.Reproduction Steps
What did you expect to happen?
RoleDefaultPolicy5FFB7DABis generated with enty allowing to encrypt published message.What actually happened?
RoleDefaultPolicy5FFB7DABcontains a permission to publish messages to topic but that's about it.CDK CLI Version
1.138.0
Framework Version
No response
Node.js Version
14.17.5
OS
MacOs BigSur
Language
Python
Language Version
3.10.1
Other information
It might not be easy to implement this because
grantPublishis defined atTopicBasethat does not contain reference tomasterKey. Question is, can we retrieve such information forTopicBaseor for topics that are being imported.