fix(secretsmanager): secret resource policy already exists in stack (…

…under feature flag) (#24365) The issue is prevalent with Database clusters, e.g. when a secret with a rotation is used and a grantee is granted access to the db cluster. The root cause of this issue is the Cluster's use of a SecretAttachmentTarget to replace the original secret. This is allowed, since SecretAttachmentTarget do implement the ISecret interface. When policy statements are added, a new resource policy is created using the SecretAttachmentTarget ARN. This only works because in CloudFormation SecretAttachmentTarget returns the ARN of the Secret. However a secret can only have a single resource policy. The above scenario leads to a policy being created for the Secret and one for the SecretAttachmentTarget. Which is then (correctly) rejected by CloudFormation. The fix is to forward any policy changes on the SecretAttachmentTarget to the attached secret. Fixes #24383 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Feb 28, 2023 · 7dd8b7e · 7dd8b7e
1 parent 3b251a5
commit 7dd8b7e
Show file tree

Hide file tree

Showing 43 changed files with 1,589 additions and 421 deletions.
diff --git a/...db/test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-docdb-cluster-rotation.assets.json b/...db/test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-docdb-cluster-rotation.assets.json
@@ -1,15 +1,15 @@
 {
-  "version": "20.0.0",
+  "version": "30.1.0",
   "files": {
-    "16960a7525b0e7f3fc99af30374461429f32d815db45bab3e136c4a994140575": {
+    "ffa0280c20139b5a0ec753fdb4365af29fb08ea9703b9139810054417bc99c10": {
       "source": {
         "path": "aws-cdk-docdb-cluster-rotation.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "16960a7525b0e7f3fc99af30374461429f32d815db45bab3e136c4a994140575.json",
+          "objectKey": "ffa0280c20139b5a0ec753fdb4365af29fb08ea9703b9139810054417bc99c10.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }

diff --git a/.../test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-docdb-cluster-rotation.template.json b/.../test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-docdb-cluster-rotation.template.json
@@ -508,7 +508,7 @@
     }
    }
   },
-  "DatabaseSecretAttachmentPolicy5ACFE6CA": {
+  "DatabaseSecretPolicyEE73D3F8": {
    "Type": "AWS::SecretsManager::ResourcePolicy",
    "Properties": {
     "ResourcePolicy": {
@@ -540,7 +540,7 @@
      "Version": "2012-10-17"
     },
     "SecretId": {
-     "Ref": "DatabaseSecretAttachmentE5D1B020"
+     "Ref": "DatabaseSecret3B817195"
     }
    }
   },

diff --git a/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/cdk.out b/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/cdk.out
@@ -1 +1 @@
-{"version":"20.0.0"}
+{"version":"30.1.0"}
diff --git a/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/integ.json b/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/integ.json
@@ -1,5 +1,5 @@
 {
-  "version": "20.0.0",
+  "version": "30.1.0",
   "testCases": {
     "integ.cluster-rotation.lit": {
       "stacks": [

diff --git a/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/manifest.json b/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/manifest.json
@@ -1,12 +1,6 @@
 {
-  "version": "20.0.0",
+  "version": "30.1.0",
   "artifacts": {
-    "Tree": {
-      "type": "cdk:tree",
-      "properties": {
-        "file": "tree.json"
-      }
-    },
     "aws-cdk-docdb-cluster-rotation.assets": {
       "type": "cdk:asset-manifest",
       "properties": {
@@ -23,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/16960a7525b0e7f3fc99af30374461429f32d815db45bab3e136c4a994140575.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/ffa0280c20139b5a0ec753fdb4365af29fb08ea9703b9139810054417bc99c10.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -213,10 +207,10 @@
             "data": "DatabaseSecretAttachmentRotationScheduleA4E9F034"
           }
         ],
-        "/aws-cdk-docdb-cluster-rotation/Database/Secret/Attachment/Policy/Resource": [
+        "/aws-cdk-docdb-cluster-rotation/Database/Secret/Policy/Resource": [
           {
             "type": "aws:cdk:logicalId",
-            "data": "DatabaseSecretAttachmentPolicy5ACFE6CA"
+            "data": "DatabaseSecretPolicyEE73D3F8"
           }
         ],
         "/aws-cdk-docdb-cluster-rotation/Database/Resource": [
@@ -260,9 +254,24 @@
             "type": "aws:cdk:logicalId",
             "data": "CheckBootstrapVersion"
           }
+        ],
+        "DatabaseSecretAttachmentPolicy5ACFE6CA": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "DatabaseSecretAttachmentPolicy5ACFE6CA",
+            "trace": [
+              "!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
+            ]
+          }
         ]
       },
       "displayName": "aws-cdk-docdb-cluster-rotation"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
     }
   }
 }
diff --git a/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/tree.json b/packages/@aws-cdk/aws-docdb/test/integ.cluster-rotation.lit.js.snapshot/tree.json
@@ -4,14 +4,6 @@
     "id": "App",
     "path": "",
     "children": {
-      "Tree": {
-        "id": "Tree",
-        "path": "Tree",
-        "constructInfo": {
-          "fqn": "constructs.Construct",
-          "version": "10.1.85"
-        }
-      },
       "aws-cdk-docdb-cluster-rotation": {
         "id": "aws-cdk-docdb-cluster-rotation",
         "path": "aws-cdk-docdb-cluster-rotation",
@@ -91,8 +83,8 @@
                     "id": "Acl",
                     "path": "aws-cdk-docdb-cluster-rotation/VPC/PublicSubnet1/Acl",
                     "constructInfo": {
-                      "fqn": "constructs.Construct",
-                      "version": "10.1.85"
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
                     }
                   },
                   "RouteTable": {
@@ -258,8 +250,8 @@
                     "id": "Acl",
                     "path": "aws-cdk-docdb-cluster-rotation/VPC/PublicSubnet2/Acl",
                     "constructInfo": {
-                      "fqn": "constructs.Construct",
-                      "version": "10.1.85"
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
                     }
                   },
                   "RouteTable": {
@@ -425,8 +417,8 @@
                     "id": "Acl",
                     "path": "aws-cdk-docdb-cluster-rotation/VPC/PrivateSubnet1/Acl",
                     "constructInfo": {
-                      "fqn": "constructs.Construct",
-                      "version": "10.1.85"
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
                     }
                   },
                   "RouteTable": {
@@ -544,8 +536,8 @@
                     "id": "Acl",
                     "path": "aws-cdk-docdb-cluster-rotation/VPC/PrivateSubnet2/Acl",
                     "constructInfo": {
-                      "fqn": "constructs.Construct",
-                      "version": "10.1.85"
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
                     }
                   },
                   "RouteTable": {
@@ -850,64 +842,64 @@
                           "fqn": "@aws-cdk/aws-secretsmanager.RotationSchedule",
                           "version": "0.0.0"
                         }
-                      },
-                      "Policy": {
-                        "id": "Policy",
-                        "path": "aws-cdk-docdb-cluster-rotation/Database/Secret/Attachment/Policy",
-                        "children": {
-                          "Resource": {
-                            "id": "Resource",
-                            "path": "aws-cdk-docdb-cluster-rotation/Database/Secret/Attachment/Policy/Resource",
-                            "attributes": {
-                              "aws:cdk:cloudformation:type": "AWS::SecretsManager::ResourcePolicy",
-                              "aws:cdk:cloudformation:props": {
-                                "resourcePolicy": {
-                                  "Statement": [
-                                    {
-                                      "Action": "secretsmanager:DeleteSecret",
-                                      "Effect": "Deny",
-                                      "Principal": {
-                                        "AWS": {
-                                          "Fn::Join": [
-                                            "",
-                                            [
-                                              "arn:",
-                                              {
-                                                "Ref": "AWS::Partition"
-                                              },
-                                              ":iam::",
-                                              {
-                                                "Ref": "AWS::AccountId"
-                                              },
-                                              ":root"
-                                            ]
-                                          ]
-                                        }
-                                      },
-                                      "Resource": "*"
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-secretsmanager.SecretTargetAttachment",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "Policy": {
+                    "id": "Policy",
+                    "path": "aws-cdk-docdb-cluster-rotation/Database/Secret/Policy",
+                    "children": {
+                      "Resource": {
+                        "id": "Resource",
+                        "path": "aws-cdk-docdb-cluster-rotation/Database/Secret/Policy/Resource",
+                        "attributes": {
+                          "aws:cdk:cloudformation:type": "AWS::SecretsManager::ResourcePolicy",
+                          "aws:cdk:cloudformation:props": {
+                            "resourcePolicy": {
+                              "Statement": [
+                                {
+                                  "Action": "secretsmanager:DeleteSecret",
+                                  "Effect": "Deny",
+                                  "Principal": {
+                                    "AWS": {
+                                      "Fn::Join": [
+                                        "",
+                                        [
+                                          "arn:",
+                                          {
+                                            "Ref": "AWS::Partition"
+                                          },
+                                          ":iam::",
+                                          {
+                                            "Ref": "AWS::AccountId"
+                                          },
+                                          ":root"
+                                        ]
+                                      ]
                                     }
-                                  ],
-                                  "Version": "2012-10-17"
-                                },
-                                "secretId": {
-                                  "Ref": "DatabaseSecretAttachmentE5D1B020"
+                                  },
+                                  "Resource": "*"
                                 }
-                              }
+                              ],
+                              "Version": "2012-10-17"
                             },
-                            "constructInfo": {
-                              "fqn": "@aws-cdk/aws-secretsmanager.CfnResourcePolicy",
-                              "version": "0.0.0"
+                            "secretId": {
+                              "Ref": "DatabaseSecret3B817195"
                             }
                           }
                         },
                         "constructInfo": {
-                          "fqn": "@aws-cdk/aws-secretsmanager.ResourcePolicy",
+                          "fqn": "@aws-cdk/aws-secretsmanager.CfnResourcePolicy",
                           "version": "0.0.0"
                         }
                       }
                     },
                     "constructInfo": {
-                      "fqn": "@aws-cdk/aws-secretsmanager.SecretTargetAttachment",
+                      "fqn": "@aws-cdk/aws-secretsmanager.ResourcePolicy",
                       "version": "0.0.0"
                     }
                   }
@@ -1025,8 +1017,8 @@
                     "id": "SARMapping",
                     "path": "aws-cdk-docdb-cluster-rotation/Database/RotationSingleUser/SARMapping",
                     "constructInfo": {
-                      "fqn": "constructs.Construct",
-                      "version": "10.1.85"
+                      "fqn": "@aws-cdk/core.CfnMapping",
+                      "version": "0.0.0"
                     }
                   },
                   "Resource": {
@@ -1120,17 +1112,41 @@
               "fqn": "@aws-cdk/aws-docdb.DatabaseCluster",
               "version": "0.0.0"
             }
+          },
+          "BootstrapVersion": {
+            "id": "BootstrapVersion",
+            "path": "aws-cdk-docdb-cluster-rotation/BootstrapVersion",
+            "constructInfo": {
+              "fqn": "@aws-cdk/core.CfnParameter",
+              "version": "0.0.0"
+            }
+          },
+          "CheckBootstrapVersion": {
+            "id": "CheckBootstrapVersion",
+            "path": "aws-cdk-docdb-cluster-rotation/CheckBootstrapVersion",
+            "constructInfo": {
+              "fqn": "@aws-cdk/core.CfnRule",
+              "version": "0.0.0"
+            }
           }
         },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      },
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
         "constructInfo": {
           "fqn": "constructs.Construct",
-          "version": "10.1.85"
+          "version": "10.1.252"
         }
       }
     },
     "constructInfo": {
-      "fqn": "constructs.Construct",
-      "version": "10.1.85"
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
     }
   }
 }
diff --git a/...-rds/test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-rds-cluster-rotation.assets.json b/...-rds/test/integ.cluster-rotation.lit.js.snapshot/aws-cdk-rds-cluster-rotation.assets.json
@@ -1,15 +1,15 @@
 {
-  "version": "21.0.0",
+  "version": "30.1.0",
   "files": {
-    "dfc2f8e8aa2f2f42357312f7f92524a12cb383c762b91eaecbbefb8ad8400f82": {
+    "f1be03db0810455e897d5600a00d7d089273d1f89b9a319be25928bf241a9490": {
       "source": {
         "path": "aws-cdk-rds-cluster-rotation.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "dfc2f8e8aa2f2f42357312f7f92524a12cb383c762b91eaecbbefb8ad8400f82.json",
+          "objectKey": "f1be03db0810455e897d5600a00d7d089273d1f89b9a319be25928bf241a9490.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }