[kms] overiding policy default statement

[pproux]

Setting a KMS policy parameter add a statement to the default policy instead of overriding the whole policy.

Reproduction Steps

    aws_kms.Key(
        self, 'mykey',
        policy = aws_iam.PolicyDocument(
            statements = [
                aws_iam.PolicyStatement(
                    effect = aws_iam.Effect('ALLOW'),
                    actions = [ 'kms:*' ],
                    principals = [ aws_iam.ArnPrincipal('arn:aws:iam::xxxxxxxxxx:root') ] 
                )
            ]
        )
    )

What did you expect to happen?

I was expecting the new KMS policy to be exactly what i set in the policy parameter :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxx:root"
            },
            "Action": "kms:*"
        }
    ]
}

What actually happened?

Instead it was added as a new statement along the default one.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxx:root"
            },
            "Action": "kms:*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxx:root"
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion",
                "kms:GenerateDataKey",
                "kms:TagResource",
                "kms:UntagResource"
            ],
            "Resource": "*"
        }
    ]
}

Environment

• CLI Version : (cdk --version) 1.64.1
• Framework Version: (pip3 list | grep aws-cdk.aws-kms) 1.64.1
• Node.js Version: (node -v) v10.16.3
• **OS : ** (uname -r) 4.14.146-93.123.amzn1.x86_64
• Language (Version): (python --version) Python 3.6.8

---

This is 🐛 Bug Report

[njlynch]

Related to #8977 (possibly a complete dupe of it). I'll keep this one open for now.

[njlynch]

@pproux - I'm circling back around to this and several related issues right now, and I wanted to clarify your use case. The key policy you are providing is to grant all permissions to the root account. This is identical to the policy you'll get if you supply trustAccountIdentities = True when creating the key. Does that actually solve your use case, or are you granting all permissions to an account other than the current stack/environment account? If so, would you mind briefly explaining your use case? I'd like to know more about why users might want to opt out of the default policies.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[pproux]

Hi @njlynch,

I have no problem with the default policy.

But i think as soon as you provide a custom one (like i did), then the the default policy should not be added.

[njlynch]

@pproux - That's exactly what the fix (released in v1.78.0) enables. Default policies will not be added if you provide a policy, if the '@aws-cdk/aws-kms:defaultKeyPolicies' feature flag is set. The flag will be enabled by default for all new CDK projects, or can be manually enabled for existing projects.