Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CDKToolkit stack with newStyleStackSynthesis creates CMK that costs 1USD/month #10115

Closed
lestephane opened this issue Sep 2, 2020 · 1 comment · Fixed by #10365
Closed

CDKToolkit stack with newStyleStackSynthesis creates CMK that costs 1USD/month #10115

lestephane opened this issue Sep 2, 2020 · 1 comment · Fixed by #10365
Assignees
@rix0rrr
Labels
@aws-cdk/pipelines CDK Pipelines library bug This issue is a bug. p0 package/tools Related to AWS CDK Tools or CLI

Comments

@lestephane
Copy link

Please make this behaviour opt-in, so that by default, the CDKToolkit does not cost anything. I never expected a support stack to cost money. There is already a standard S3 KMS key that costs nothing, and it's enough for trying things out.
@lestephane lestephane added guidance Question that needs advice or information. needs-triage This issue or PR still needs to be triaged. labels Sep 2, 2020
@SomayaB SomayaB self-assigned this Sep 3, 2020
@SomayaB SomayaB changed the title [general] The CDKToolkit stack created by the cdk incurs 1USD/month cost because it creates a new customer master key [CLI] The CDKToolkit stack created by the cdk incurs 1USD/month cost because it creates a new customer master key Sep 3, 2020
@github-actions github-actions bot added the package/tools Related to AWS CDK Tools or CLI label Sep 3, 2020
@SomayaB SomayaB assigned NGL321 and unassigned shivlaks Sep 3, 2020
@SomayaB SomayaB added the feature-request A feature should be added or improved. label Sep 3, 2020
@SomayaB SomayaB changed the title [CLI] The CDKToolkit stack created by the cdk incurs 1USD/month cost because it creates a new customer master key The CDKToolkit stack created by the cdk incurs 1USD/month cost because it creates a new customer master key Sep 3, 2020
@NGL321 NGL321 added bug This issue is a bug. p0 and removed feature-request A feature should be added or improved. guidance Question that needs advice or information. needs-triage This issue or PR still needs to be triaged. labels Sep 3, 2020
@NGL321 NGL321 assigned rix0rrr and unassigned NGL321 and SomayaB Sep 3, 2020
@NGL321
Copy link
Contributor

NGL321 commented Sep 3, 2020

Hi @lestephane,

It looks like this is an issue with the new style bootstrapping. I just bootstrapped both old and new style and with the old style the stack only contains the resources StagingBucket and StagingBucketPolicy. The new style does contain a CMK.

Thank you for the catch!

😸 😷

@NGL321 NGL321 added the @aws-cdk/pipelines CDK Pipelines library label Sep 4, 2020
@NGL321 NGL321 changed the title The CDKToolkit stack created by the cdk incurs 1USD/month cost because it creates a new customer master key CDKToolkit stack with newStyleStackSynthesis creates CMK that costs 1USD/month Sep 4, 2020
rix0rrr added a commit that referenced this issue Sep 15, 2020
@rix0rrr
fix(bootstrap): no longer creates KMS master key by default
fa5cbcd 
The modern bootstrap stack used to unconditionally create a KMS Customer
Master Key (CMK) for users. This incurs a $1/month charge for every user
of the CDK for every region and account they want to deploy in, which is
not acceptable if we're going to make this the default bootstrapping
experience in the future.

This PR switches off the creation of the CMK by default for new
bootstrap stacks. Bootstrap stacks that already exist can remove the
existing CMK by running:

```
cdk bootstrap --bootstrap-customer-key=false [aws://...]
```

This change is backwards compatible: updates to existing (modern)
bootstrap stacks will leave the current KMS key in place. To achieve
this, the new default is encoded into the CLI, not into the template.

Fixes #10115.
@rix0rrr rix0rrr mentioned this issue Sep 15, 2020
Merged
rix0rrr added a commit that referenced this issue Sep 16, 2020
@rix0rrr
feat(pipelines): allow disabling of KMS keys
6d2f23b 
KMS keys for cross-account actions used to be created automatically,
but incur a $1/month charge for every region, adding a charge you
don't need if you don't plan to deploy in to cross-account destinations.

Add the option `crossAccountKeys: false` to allow users to switch off
the KMS keys and avoid the charge if they don't need it.

Relates to #10115.
@rix0rrr rix0rrr mentioned this issue Sep 16, 2020
Merged
@mergify mergify bot closed this as completed in #10365 Sep 17, 2020
mergify bot pushed a commit that referenced this issue Sep 17, 2020
@rix0rrr
fix(bootstrap): no longer creates KMS master key by default (#10365)
bedd4c0 
The modern bootstrap stack used to unconditionally create a KMS Customer
Master Key (CMK) for users. This incurs a $1/month charge for every user
of the CDK for every region and account they want to deploy in, which is
not acceptable if we're going to make this the default bootstrapping
experience in the future.

This PR switches off the creation of the CMK by default for new
bootstrap stacks. Bootstrap stacks that already exist can remove the
existing CMK by running:

```
cdk bootstrap --bootstrap-customer-key=false [aws://...]
```

This change is backwards compatible: updates to existing (modern)
bootstrap stacks will leave the current KMS key in place. To achieve
this, the new default is encoded into the CLI, not into the template.

Fixes #10115.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
mergify bot pushed a commit that referenced this issue Sep 29, 2020
@rix0rrr
feat(pipelines): allow disabling of KMS keys (#10396)
1f7311f 
KMS keys for cross-account actions used to be created automatically,
but incur a $1/month charge for every region, adding a charge you
don't need if you don't plan to deploy in to cross-account destinations.

Add the option `crossAccountKeys: false` to allow users to switch off
the KMS keys and avoid the charge if they don't need it.

Relates to #10115.

Must not be merged before #10474.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rix0rrr rix0rrr

Labels
@aws-cdk/pipelines CDK Pipelines library bug This issue is a bug. p0 package/tools Related to AWS CDK Tools or CLI
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(bootstrap): no longer creates KMS master key by default aws/aws-cdk
5 participants
@rix0rrr @NGL321 @lestephane @SomayaB @shivlaks