Update with tests for cross-account KMS key grant

aws · Dec 17, 2023 · aadaafc · aadaafc
1 parent aea48db
commit aadaafc
Show file tree

Hide file tree

Showing 3 changed files with 350 additions and 63 deletions.
diff --git a/packages/aws-cdk-lib/aws-lambda/test/params-and-secrets.test.ts b/packages/aws-cdk-lib/aws-lambda/test/params-and-secrets.test.ts
@@ -433,6 +433,32 @@ describe('params and secrets', () => {
               Ref: 'SecretA720EF05',
             },
           },
+          {
+            Action: 'kms:Decrypt',
+            Condition: {
+              StringEquals: {
+                'kms:ViaService': {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'secretsmanager.',
+                      {
+                        Ref: 'AWS::Region',
+                      },
+                      '.amazonaws.com',
+                    ],
+                  ],
+                },
+              },
+            },
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': [
+                'Key961B73FD',
+                'Arn',
+              ],
+            },
+          },
         ],
         Version: '2012-10-17',
       },
@@ -555,35 +581,6 @@ describe('params and secrets', () => {
             },
             Resource: '*',
           },
-          {
-            Action: 'kms:Decrypt',
-            Condition: {
-              StringEquals: {
-                'kms:ViaService': {
-                  'Fn::Join': [
-                    '',
-                    [
-                      'secretsmanager.',
-                      {
-                        Ref: 'AWS::Region',
-                      },
-                      '.amazonaws.com',
-                    ],
-                  ],
-                },
-              },
-            },
-            Effect: 'Allow',
-            Principal: {
-              AWS: {
-                'Fn::GetAtt': [
-                  'FunctionServiceRole675BB04A',
-                  'Arn',
-                ],
-              },
-            },
-            Resource: '*',
-          },
         ]),
       },
     });

diff --git a/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts b/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts
@@ -382,7 +382,7 @@ abstract class SecretBase extends Resource implements ISecret {
     if (this.encryptionKey) {
       // @see https://docs.aws.amazon.com/kms/latest/developerguide/services-secrets-manager.html
       this.encryptionKey.grantDecrypt(
-        new kms.ViaServicePrincipal(`secretsmanager.${Stack.of(this).region}.amazonaws.com`, grantee.grantPrincipal),
+        new kms.ViaServicePrincipal(`secretsmanager.${Stack.of(this).region}.amazonaws.com`, grantee.grantPrincipal)
       );
     }