fix(codebuild): Secret env variable from another account fails on Key decryption

[Kruspe]

When providing a secretArn for the EnvironmentVariables allow kms:Decrypt
action for any key so that CodeBuild is able to get secrets that are stored
in different accounts.

fixes #14043

---

@skinny85 I didn't implement the if statement we talked about to check weither the secret actually lives in another account, since I wasn't able to come up with a good test for that. Any suggestions on this?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[skinny85]

Thanks for the contribution @Kruspe!

@skinny85 I didn't implement the if statement we talked about to check weither the secret actually lives in another account, since I wasn't able to come up with a good test for that. Any suggestions on this?

It's actually very easy to write tests in the CDK for cross-account usecases - they look exactly like other unit tests, you just provide different account numbers when creating the Stacks. Here's a simple example from the CodePipeline tests:

aws-cdk/packages/@aws-cdk/aws-codepipeline-actions/test/pipeline.test.ts

Lines 966 to 1049 in 8a949dc

	'adds a dependency on the Stack containing a new action Role'(test: Test) {
	const region = 'us-west-2';
	const pipelineAccount = '123456789012';
	const buildAccount = '901234567890';
	const app = new App();
	const buildStack = new Stack(app, 'BuildStack', {
	env: { account: buildAccount, region },
	});
	const actionRolePhysicalName = 'ProjectRolePhysicalName';
	const actionRoleInOtherAccount = new iam.Role(buildStack, 'ProjectRole', {
	assumedBy: new iam.AccountPrincipal(pipelineAccount),
	roleName: actionRolePhysicalName,
	});
	const projectPhysicalName = 'ProjectPhysicalName';
	const project = codebuild.Project.fromProjectName(buildStack, 'Project',
	projectPhysicalName);
	const pipelineStack = new Stack(app, 'PipelineStack', {
	env: { account: pipelineAccount, region },
	});
	const bucket = new s3.Bucket(pipelineStack, 'ArtifactBucket', {
	bucketName: 'source-bucket',
	encryption: s3.BucketEncryption.KMS,
	});
	const sourceOutput = new codepipeline.Artifact();
	new codepipeline.Pipeline(pipelineStack, 'Pipeline', {
	artifactBucket: bucket,
	stages: [
	{
	stageName: 'Source',
	actions: [
	new cpactions.S3SourceAction({
	actionName: 'S3',
	bucket,
	bucketKey: 'path/to/file.zip',
	output: sourceOutput,
	}),
	],
	},
	{
	stageName: 'Build',
	actions: [
	new cpactions.CodeBuildAction({
	actionName: 'CodeBuild',
	project,
	input: sourceOutput,
	role: actionRoleInOtherAccount,
	}),
	],
	},
	],
	});
	expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
	'Stages': [
	{
	'Name': 'Source',
	},
	{
	'Name': 'Build',
	'Actions': [
	{
	'Name': 'CodeBuild',
	'Configuration': {
	'ProjectName': projectPhysicalName,
	},
	'RoleArn': {
	'Fn::Join': ['', [
	'arn:',
	{ 'Ref': 'AWS::Partition' },
	`:iam::${buildAccount}:role/${actionRolePhysicalName}`,
	]],
	},
	},
	],
	},
	],
	}));
	test.equal(pipelineStack.dependencies.length, 1);
	test.done();
	},

[Kruspe]

@skinny85 thanks for the hint! Should be ready for review now.
I do not think this needs a README change. Let me know if you think otherwise.

[skinny85]

Looks great @Kruspe! Couple of minor changes before we merge this in. Thanks for the contribution!

Pull request has been modified.

[Kruspe]

Alright. Thanks for the suggestions. I think all of them are valid and they are now implemented.

[skinny85]

Looks awesome @Kruspe, thanks so much for the contribution!

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: 642fbcd
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).