feat!(app-staging-synthesizer-alpha): use S3-Managed encryption by de…

…fault

packages/@aws-cdk/app-staging-synthesizer-alpha/README.md

@@ -267,16 +267,16 @@ const app = new App({
 
 ### Staging Bucket Encryption
 
-By default, the staging resources will be stored in an S3 Bucket with KMS encryption. To use
-SSE-S3, set `stagingBucketEncryption` to `BucketEncryption.S3_MANAGED`.
+By default, the staging resources will be stored in an S3 Bucket with S3 Managed encryption. To use
+SSE-KMS, set `stagingBucketEncryption` to `BucketEncryption.KMS`.
 
 ```ts
 import { BucketEncryption } from 'aws-cdk-lib/aws-s3';
 
 const app = new App({
   defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
     appId: 'my-app-id',
-    stagingBucketEncryption: BucketEncryption.S3_MANAGED,
+    stagingBucketEncryption: BucketEncryption.KMS,
   }),
 });
 ```

packages/@aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts

@@ -64,7 +64,7 @@ export interface DefaultStagingStackOptions {
   /**
    * Encryption type for staging bucket
    *
-   * @default - s3.BucketEncryption.KMS
+   * @default - s3.BucketEncryption.S3_MANAGED
    */
   readonly stagingBucketEncryption?: s3.BucketEncryption;
 
@@ -226,7 +226,7 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
 
   private readonly appId: string;
   private readonly stagingBucketName?: string;
-  private stagingBucketEncryption?: s3.BucketEncryption;
+  private stagingBucketEncryption: s3.BucketEncryption;
 
   /**
    * File publish role ARN in asset manifest format
@@ -267,7 +267,7 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
 
     this.deployRoleArn = props.deployRoleArn;
     this.stagingBucketName = props.stagingBucketName;
-    this.stagingBucketEncryption = props.stagingBucketEncryption;
+    this.stagingBucketEncryption = props.stagingBucketEncryption ?? s3.BucketEncryption.S3_MANAGED;
     const specializer = new StringSpecializer(this, props.qualifier);
 
     this.providedFileRole = props.fileAssetPublishingRole?._specialize(specializer);
@@ -368,15 +368,6 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
 
     this.ensureFileRole();
 
-    let key = undefined;
-    if (this.stagingBucketEncryption === s3.BucketEncryption.KMS || this.stagingBucketEncryption === undefined) {
-      if (this.stagingBucketEncryption === undefined) {
-        // default is KMS as an AWS best practice, and for backwards compatibility
-        this.stagingBucketEncryption = s3.BucketEncryption.KMS;
-      }
-      key = this.createBucketKey();
-    }
-
     // Create the bucket once the dependencies have been created
     const bucket = new s3.Bucket(this, bucketId, {
       bucketName: stagingBucketName,
@@ -387,7 +378,7 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
         removalPolicy: RemovalPolicy.RETAIN,
       }),
       encryption: this.stagingBucketEncryption,
-      encryptionKey: key,
+      encryptionKey: this.stagingBucketEncryption === s3.BucketEncryption.KMS ? this.createBucketKey() : undefined,
 
       // Many AWS account safety checkers will complain when buckets aren't versioned
       versioned: true,

packages/@aws-cdk/app-staging-synthesizer-alpha/test/app-staging-synthesizer.test.ts

@@ -277,26 +277,26 @@ describe(AppStagingSynthesizer, () => {
             Status: 'Enabled',
           }]),
         },
-        // When stagingBucketEncryption is not specified, it should be KMS for backwards compatibility
+        // When stagingBucketEncryption is not specified, it should be S3_MANAGED
         BucketEncryption: {
           ServerSideEncryptionConfiguration: [
             {
               ServerSideEncryptionByDefault: {
-                SSEAlgorithm: 'aws:kms',
+                SSEAlgorithm: 'AES256',
               },
             },
           ],
         },
       });
     });
 
-    test('staging bucket with SSE-S3 encryption', () => {
+    test('staging bucket with SSE-KMS encryption', () => {
       // GIVEN
       app = new App({
         defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
           appId: APP_ID,
           deployTimeFileAssetLifetime: Duration.days(1),
-          stagingBucketEncryption: BucketEncryption.S3_MANAGED,
+          stagingBucketEncryption: BucketEncryption.KMS,
         }),
       });
       stack = new Stack(app, 'Stack', {
@@ -318,7 +318,7 @@ describe(AppStagingSynthesizer, () => {
           ServerSideEncryptionConfiguration: [
             {
               ServerSideEncryptionByDefault: {
-                SSEAlgorithm: 'AES256',
+                SSEAlgorithm: 'aws:kms',
               },
             },
           ],

packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/StagingStack-default-resourcesmax-ACCOUNT-REGION.template.json

@@ -85,22 +85,6 @@
          ]
         }
        ]
-      },
-      {
-       "Action": [
-        "kms:Decrypt",
-        "kms:DescribeKey",
-        "kms:Encrypt",
-        "kms:GenerateDataKey*",
-        "kms:ReEncrypt*"
-       ],
-       "Effect": "Allow",
-       "Resource": {
-        "Fn::GetAtt": [
-         "BucketKey7092080A",
-         "Arn"
-        ]
-       }
       }
      ],
      "Version": "2012-10-17"
@@ -113,105 +97,14 @@
     ]
    }
   },
-  "BucketKey7092080A": {
-   "Type": "AWS::KMS::Key",
-   "Properties": {
-    "KeyPolicy": {
-     "Statement": [
-      {
-       "Action": "kms:*",
-       "Effect": "Allow",
-       "Principal": {
-        "AWS": {
-         "Fn::Join": [
-          "",
-          [
-           "arn:",
-           {
-            "Ref": "AWS::Partition"
-           },
-           ":iam::",
-           {
-            "Ref": "AWS::AccountId"
-           },
-           ":root"
-          ]
-         ]
-        }
-       },
-       "Resource": "*"
-      },
-      {
-       "Action": [
-        "kms:CancelKeyDeletion",
-        "kms:Create*",
-        "kms:Delete*",
-        "kms:Describe*",
-        "kms:Disable*",
-        "kms:Enable*",
-        "kms:Get*",
-        "kms:List*",
-        "kms:Put*",
-        "kms:Revoke*",
-        "kms:ScheduleKeyDeletion",
-        "kms:TagResource",
-        "kms:UntagResource",
-        "kms:Update*"
-       ],
-       "Effect": "Allow",
-       "Principal": {
-        "AWS": {
-         "Fn::Join": [
-          "",
-          [
-           "arn:",
-           {
-            "Ref": "AWS::Partition"
-           },
-           ":iam::",
-           {
-            "Ref": "AWS::AccountId"
-           },
-           ":root"
-          ]
-         ]
-        }
-       },
-       "Resource": "*"
-      }
-     ],
-     "Version": "2012-10-17"
-    }
-   },
-   "UpdateReplacePolicy": "Retain",
-   "DeletionPolicy": "Retain"
-  },
-  "BucketKeyAlias69A0886F": {
-   "Type": "AWS::KMS::Alias",
-   "Properties": {
-    "AliasName": "alias/cdk-default-resourcesmax-staging",
-    "TargetKeyId": {
-     "Fn::GetAtt": [
-      "BucketKey7092080A",
-      "Arn"
-     ]
-    }
-   }
-  },
   "CdkStagingBucket1636058C": {
    "Type": "AWS::S3::Bucket",
    "Properties": {
     "BucketEncryption": {
      "ServerSideEncryptionConfiguration": [
       {
        "ServerSideEncryptionByDefault": {
-        "KMSMasterKeyID": {
-         "Fn::GetAtt": [
-          "BucketKey7092080A",
-          "Arn"
-         ]
-        },
-        "SSEAlgorithm": "aws:kms"
+        "SSEAlgorithm": "AES256"
        }
       }
      ]