[sqs] Circular dependency between resources when encrypting sqs queue with kms and assigning target to rule

[prabint]

I am setting up an event bridge rule that will forward events from Macie to sqs. Everything works fine until I add encryptionMasterKey to the queue. I either have to remove the .encryptionMasterKey or remove the .target() to avoid circular dependency error.

Reproduction Steps

val queue = Queue.Builder.create(scope, "MacieReportQueue")
             .queueName("MacieReportQueue")
             // TODO: FIXME: KMS Circular dependency error when combined with target
             //  https://github.com/aws/aws-cdk/issues/3067
             .encryption(QueueEncryption.KMS)
             .encryptionMasterKey(key)
             .build()

     val target = SqsQueue.Builder.create(queue).build()

     val rule = Rule.Builder.create(scope, "MacieToSqsEventBridgeRule")
             .ruleName("MacieToSqsEventBridgeRule")
             .description("Sends messages to SQS if Macie finds sensitive information")
             .targets(listOf(target))
             .eventPattern(EventPattern.builder()
                     .source(listOf("aws.macie"))
                     .build()
             )
             .build()

CF Graph

What did you expect to happen?

No circular dependency error. Queue should be encrypted.

What actually happened?

Circular dependency between resources: [MacieReportQueue7D1A954B, MacieReportQueuePolicy84D89C73, MacieToSqsEventBridgeRule498CF606, MacieReportQueueKeyAliasA0A0C899, MacieReportQueueKeyF608AAD8]

Environment

• **CLI Version :1.67.0 (build 2b4dd71)
• **Framework Version:1.67.0
• Node.js Version: v14.13.1
• OS : Mac 10.14.6
• Language (Version): Java 8

Other

---

This is 🐛 Bug Report

[jamesholmes-linktree]

I hit the same issue with an encrypted queue. The issue is this addition to the Key Policy when the target is created:

{
              "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Condition": {
                "ArnEquals": {
                  "aws:SourceArn": {
                    "Fn::GetAtt": [
                      "Rule123456",
                      "Arn"
                    ]
                  }
                }
              },
              "Effect": "Allow",
              "Principal": {
                "Service": "events.amazonaws.com"
              },
              "Resource": "*"
            }

The Key now depends on the Rule ARN as a condition; the rule depends on the queue ARN as a target and; the queue depends on the key ARN to encrypt it. There's the circle.

[rix0rrr]

This is pretty much unfixable by design the way Key Policies work in KMS, as long as this is not implemented: aws-cloudformation/cloudformation-coverage-roadmap#322

[rix0rrr]

I would be okay dropping the Condition and just trusting AWS Events wholesale. Looping in @njlynch as the master of KMS.

[rix0rrr]

Think I disagree with priority as well. This should work and there's no workaround.

[element7771]

+1

Faced this problem on project. Still present in cdk 1.80.0.
It will be nice, if you are able to fix it in the nearest versions.

Thanks!

[njlynch]

Missed this mention over the holidays... I agree that removing the condition is likely the simplest approach here.

[sudopla]

Running into this same problem. Removing the condition would be great

[Rajesh734]

I am having the exact same issue with my cdk project. I created a SQS queue with masterkey and created EventBridge Target. By default AWS-CDK adds SQSQueuePolicy which I can't alter and remove the condition defined in the Policy. Hence, can't remove the circular dependency.

How can this be fixed in aws cdk project?

I am using: Nodejs, aws-cdk

[sudopla]

I'm using the CFN class to circumvent this problem for now.

const cfnRule = eventRule.node.defaultChild as events.CfnRule
cfnRule.targets = [
    {
        arn: queue.queueArn,
        id: 'EventQueue-Target',
    }
]

You will also need to define the following permissions

// Gives EventBridge rule permission to send message to queue target            
queue.addToResourcePolicy(new iam.PolicyStatement({
    actions: ['sqs:SendMessage'],
    resources: [queue.queueArn],
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    conditions: {
        'ArnEquals': {'aws:SourceArn': eventRule.ruleArn}
    }
}))

// Give EventBridge access to KMS key
sqsKmsKey.addToResourcePolicy(new iam.PolicyStatement({
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    actions: ['kms:Decrypt', 'kms:GenerateDataKey'],
    resources: ['*']
}))

[Rajesh734]

I'm using the CFN class to circumvent this problem for now.

const cfnRule = eventRule.node.defaultChild as events.CfnRule
cfnRule.targets = [
    {
        arn: queue.queueArn,
        id: 'EventQueue-Target',
    }
]

You will also need to define the following permissions

// Gives EventBridge rule permission to send message to queue target            
queue.addToResourcePolicy(new iam.PolicyStatement({
    actions: ['sqs:SendMessage'],
    resources: [queue.queueArn],
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    conditions: {
        'ArnEquals': {'aws:SourceArn': eventRule.ruleArn}
    }
}))

// Give EventBridge access to KMS key
sqsKmsKey.addToResourcePolicy(new iam.PolicyStatement({
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    actions: ['kms:Decrypt', 'kms:GenerateDataKey'],
    resources: ['*']
}))

Didn't think about CFN class. Thank you @sudopla !

[madeline-k]

Taking a look at this one. I'm planning to remove the condition from being added here: https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-events-targets/lib/sqs.ts#L58-L60 in the case where the queue is encrypted.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[ryparker]

Ran into this when troubleshooting a similar issue on StackOverflow

A circular dependency error is thrown when using a KMS key for encrypting an S3 bucket and an SQS queue, then setup a notification on the S3 bucket to message the SQS queue.

See repro code

It looks like the root problem is that the following condition is added to the KMS key:

KMS key resource Properties.KeyPolicy.Statement[1]:

{
	"Action": [
		"kms:Decrypt",
	 	"kms:Encrypt",
		 "kms:ReEncrypt*",
		 "kms:GenerateDataKey*"
	 ],
	 "Condition": {
	 	"ArnLike": {
	    	"aws:SourceArn": {
	      		"Fn::GetAtt": [
	        		"ssls3bucketrawkms4B1E1122",
	        		"Arn"
	     		 ]
	   		 }
	 	 }
 	 },
},

The S3 bucket depends on the KMS key for encryption, and the KMS key has a condition that depends on the S3 bucket.

Workaround

I was able to deploy the stack after using escape hatches to delete the condition:

# Delete the circular reference
cfn_kms_key = kms_key.node.default_child
cfn_kms_key.add_property_deletion_override("KeyPolicy.Statement.1")

workaround code available here

---

Created a new issue for this.