feat(eks): envelope encryption for secrets

[davidsung]

feat(eks): envelope encryption for secrets

This PR adds envelope encryption support for Amazon EKS. Added a new key secretsEncryptionKey in ClusterProps for users to specify their own KMS CMK upon cluster creation:

new eks.Cluster(this, 'Cluster', {
  version: eks.KubernetesVersion.V1_16,
  secretsEncryptionKey,
});

Closes: #9140

---

Considerations

1. Confirmed Secrets Encryption is enabled in the provisioned Amazon EKS (both standard resource AWS::EKS::Cluster and custom resource Custom::AWSCDK-EKS-Cluster) after running an integration test from scratch.
2. By inspecting the CloudTrail logs after the integration test, confirmed the exact KMS IAM permission required for the cluster creation role as ['kms:Encrypt', 'kms:Decrypt', 'kms:DescribeKey', 'kms:CreateGrant']. Note: The encryption provider is using its own way to generate data encryption key, not using KMS GenerateDataKey, and hence IAM permissionkms:GenerateDataKey* is not required.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mergify]

Title does not follow the guidelines of Conventional Commits. Please adjust title before merge.

[iliapolo]

@davidsung this is ready for review yes?

[davidsung]

@davidsung this is ready for review yes?

yes @iliapolo thanks!

[davidsung]

@iliapolo As @eladb already started working on this #9472, feel free to close this one whenever you like.

[eladb]

Ha ha... Just submitted a PR for this yesterday as well... I'll close it in favor of this one.

One thing to note: I don't believe EKS supports updating the encryption configuration, so we need to fail in an update is attempted. See this.

Additionally, please add unit tests to the cluster provider - see this as a reference: https://github.com/aws/aws-cdk/pull/9472/files#diff-1cc6461fbdf09ac0273cadbbe91bd2fc

[eladb]

@iliapolo As @eladb already started working on this #9472, feel free to close this one whenever you like.

@davidsung you be great if you want to follow up on this and complete it.

[davidsung]

Ha ha... Just submitted a PR for this yesterday as well... I'll close it in favor of this one.

One thing to note: I don't believe EKS supports updating the encryption configuration, so we need to fail in an update is attempted. See this.

Additionally, please add unit tests to the cluster provider - see this as a reference: https://github.com/aws/aws-cdk/pull/9472/files#diff-1cc6461fbdf09ac0273cadbbe91bd2fc

Exactly! I will handle the update event like what you did with the next PR. Thanks!

Pull request has been modified.

[davidsung]

@iliapolo I have followed all the suggestions from @eladb and submitted again. It's ready for review. Thanks!

[davidsung]

@iliapolo As @eladb already started working on this #9472, feel free to close this one whenever you like.

@davidsung you be great if you want to follow up on this and complete it.

@eladb i have made the changes according to your advise. kindly review! Thanks!

[eladb]

Waiting for AWS SDK to be updated in lambda

[iliapolo]

Hi @davidsung - FYI The PR is approved but there are some merge conflicts that needs resolving.

[davidsung]

Hi @davidsung - FYI The PR is approved but there are some merge conflicts that needs resolving.

I will rebase this upstream master branch on the forked repo and resolve the conflicts there. I hope this can be done within the next 2 days.

[mergify]

Title does not follow the guidelines of Conventional Commits. Please adjust title before merge.

Pull request has been modified.

[davidsung]

Hi @davidsung - FYI The PR is approved but there are some merge conflicts that needs resolving.

I will rebase this upstream master branch on the forked repo and resolve the conflicts there. I hope this can be done within the next 2 days.

Hi @iliapolo, I've resolved the conflicts. This PR is now ready for your review. Thanks!

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 69b9adc
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).