feat(codepipeline): make the default CodePipeline Bucket have an encr…

…yption key (#2241) This is a prerequisite for having a nice cross-account experience (see #1924).
aws · Apr 24, 2019 · ef9bba5 · ef9bba5
1 parent fe9d6ed
commit ef9bba5
Show file tree

Hide file tree

Showing 12 changed files with 1,314 additions and 23 deletions.
diff --git a/...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json b/...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
@@ -7,9 +7,92 @@
  "Triggers": []
  }
  },
+ "PipelineArtifactsBucketEncryptionKey01D58D69" : {
+ "Type": "AWS::KMS::Key",
+ "DeletionPolicy": "Retain",
+ "Properties": {
+ "KeyPolicy": {
+ "Statement": [
+ {
+ "Action": [
+ "kms:Create*",
+ "kms:Describe*",
+ "kms:Enable*",
+ "kms:List*",
+ "kms:Put*",
+ "kms:Update*",
+ "kms:Revoke*",
+ "kms:Disable*",
+ "kms:Get*",
+ "kms:Delete*",
+ "kms:ScheduleKeyDeletion",
+ "kms:CancelKeyDeletion"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":iam::",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":root"
+ ]
+ ]
+ }
+ },
+ "Resource": "*"
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::GetAtt": [
+ "PipelineRoleD68726F7",
+ "Arn"
+ ]
+ }
+ },
+ "Resource": "*"
+ }
+ ],
+ "Version": "2012-10-17"
+ }
+ }
+ },
  "PipelineArtifactsBucket22248F97": {
  "Type": "AWS::S3::Bucket",
- "DeletionPolicy": "Retain"
+ "DeletionPolicy": "Retain",
+ "Properties": {
+ "BucketEncryption": {
+ "ServerSideEncryptionConfiguration": [
+ {
+ "ServerSideEncryptionByDefault": {
+ "KMSMasterKeyID": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ },
+ "SSEAlgorithm": "aws:kms"
+ }
+ }
+ ]
+ }
+ }
  },
  "PipelineRoleD68726F7": {
  "Type": "AWS::IAM::Role",
@@ -76,6 +159,22 @@
  }
  ]
  },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Resource": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ }
+ },
  {
  "Action": [
  "codecommit:GetBranch",
@@ -285,7 +384,16 @@
  "Location": {
  "Ref": "PipelineArtifactsBucket22248F97"
  },
- "Type": "S3"
+ "Type": "S3",
+ "EncryptionKey": {
+ "Id": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ },
+ "Type": "KMS"
+ }
  }
  },
  "DependsOn": [
@@ -342,4 +450,4 @@
  }
  }
  }
-}
+}
diff --git a/...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json b/...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
@@ -1,8 +1,129 @@
 {
  "Resources": {
+ "PipelineArtifactsBucketEncryptionKey01D58D69": {
+ "Type": "AWS::KMS::Key",
+ "DeletionPolicy": "Retain",
+ "Properties": {
+ "KeyPolicy": {
+ "Statement": [
+ {
+ "Action": [
+ "kms:Create*",
+ "kms:Describe*",
+ "kms:Enable*",
+ "kms:List*",
+ "kms:Put*",
+ "kms:Update*",
+ "kms:Revoke*",
+ "kms:Disable*",
+ "kms:Get*",
+ "kms:Delete*",
+ "kms:ScheduleKeyDeletion",
+ "kms:CancelKeyDeletion"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":iam::",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":root"
+ ]
+ ]
+ }
+ },
+ "Resource": "*"
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::GetAtt": [
+ "PipelineRoleD68726F7",
+ "Arn"
+ ]
+ }
+ },
+ "Resource": "*"
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::GetAtt": [
+ "CdkBuildProjectRoleE0B6FEB0",
+ "Arn"
+ ]
+ }
+ },
+ "Resource": "*"
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": {
+ "Fn::GetAtt": [
+ "LambdaBuildProjectRoleD0C4F982",
+ "Arn"
+ ]
+ }
+ },
+ "Resource": "*"
+ }
+ ],
+ "Version": "2012-10-17"
+ }
+ }
+ },
  "PipelineArtifactsBucket22248F97": {
  "Type": "AWS::S3::Bucket",
- "DeletionPolicy": "Retain"
+ "DeletionPolicy": "Retain",
+ "Properties": {
+ "BucketEncryption": {
+ "ServerSideEncryptionConfiguration": [
+ {
+ "ServerSideEncryptionByDefault": {
+ "KMSMasterKeyID": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ },
+ "SSEAlgorithm": "aws:kms"
+ }
+ }
+ ]
+ }
+ }
  },
  "PipelineRoleD68726F7": {
  "Type": "AWS::IAM::Role",
@@ -69,6 +190,22 @@
  }
  ]
  },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Resource": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ }
+ },
  {
  "Action": [
  "codecommit:GetBranch",
@@ -346,7 +483,16 @@
  "Location": {
  "Ref": "PipelineArtifactsBucket22248F97"
  },
- "Type": "S3"
+ "Type": "S3",
+ "EncryptionKey": {
+ "Id": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ },
+ "Type": "KMS"
+ }
  }
  },
  "DependsOn": [
@@ -737,6 +883,22 @@
  ]
  }
  ]
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Resource": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ }
  }
  ],
  "Version": "2012-10-17"
@@ -894,6 +1056,22 @@
  ]
  }
  ]
+ },
+ {
+ "Action": [
+ "kms:Decrypt",
+ "kms:DescribeKey",
+ "kms:Encrypt",
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*"
+ ],
+ "Effect": "Allow",
+ "Resource": {
+ "Fn::GetAtt": [
+ "PipelineArtifactsBucketEncryptionKey01D58D69",
+ "Arn"
+ ]
+ }
  }
  ],
  "Version": "2012-10-17"