fix(events-targets): circular dependency when adding a KMS-encrypted SQS queue

[madeline-k]

fixes #11158

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[madeline-k]

I discussed with @njlynch offline about this issue and he recommended this solution. Thank you, Nick! :)

I want to callout that this change both removes the Condition in the Key Policy and the Queue Policy. In this example that was generated prior to the change in this PR (this template would fail to deploy because of the circular dependency MyKey -> MyRule and MyRule -> MyQueue -> MyKey), the change in this PR would remove the condition

        Condition:
          ArnEquals:
            aws:SourceArn:
              Fn::GetAtt:
                - MyRuleA44AB831
                - Arn

from both the Key policy and the Queue policy, because both of these policies are modified in https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-sqs/lib/queue-base.ts#L202-L213

Full example:

MyKey6AB29FA6:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Statement:
          - Action: kms:*
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
            Resource: "*"
          - Action:
              - kms:Decrypt
              - kms:Encrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - MyRuleA44AB831
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource: "*"
        Version: "2012-10-17"
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Metadata:
      aws:cdk:path: HelloCdkStack/MyKey/Resource
  MyQueueE6CA6235:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId:
        Fn::GetAtt:
          - MyKey6AB29FA6
          - Arn
      QueueName: MyQueue
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: HelloCdkStack/MyQueue/Resource
  MyQueuePolicy6BBEDDAC:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - sqs:SendMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - MyRuleA44AB831
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - MyQueueE6CA6235
                - Arn
        Version: "2012-10-17"
      Queues:
        - Ref: MyQueueE6CA6235
    Metadata:
      aws:cdk:path: HelloCdkStack/MyQueue/Policy/Resource
  MyRuleA44AB831:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: rate(1 day)
      State: ENABLED
      Targets:
        - Arn:
            Fn::GetAtt:
              - MyQueueE6CA6235
              - Arn
          Id: Target0

@rix0rrr, Let me know if you think we should try to only remove the condition on the Key policy. I think that would require a bigger change.

[njlynch]

@madeline-k - ACK that this will impact both the queue and key policies. I personally think that's acceptable, although I'm open to contrary arguments. I'd proceed with this implementation.

[njlynch]

Looks good, with one nitpick and one kinda nitpick.

[njlynch]

🎉 Looks good to me!

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: b9b9d98
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).