Skip to content

Commit

Permalink
feat(codepipeline): make the default, implicit CodePipeline Bucket ha…
Browse files Browse the repository at this point in the history 
…ve an encryption key.

This is a prerequisite for having a nice cross-account experience
(see #1924).
  • Loading branch information
@skinny85
skinny85 committed Apr 10, 2019
1 parent 464cb6f commit f8f90b7
Show file tree
Hide file tree
Showing 11 changed files with 1,174 additions and 26 deletions.
114 changes: 111 additions & 3 deletions ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,92 @@
"Triggers": []
}
},
"PipelineArtifactsBucketEncryptionKey01D58D69" : {
"Type": "AWS::KMS::Key",
"DeletionPolicy": "Retain",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
}
},
"PipelineArtifactsBucket22248F97": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
"DeletionPolicy": "Retain",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"KMSMasterKeyID": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"SSEAlgorithm": "aws:kms"
}
}
]
}
}
},
"PipelineRoleD68726F7": {
"Type": "AWS::IAM::Role",
Expand Down Expand Up @@ -76,6 +159,22 @@
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
},
{
"Action": [
"codecommit:GetBranch",
Expand Down Expand Up @@ -285,7 +384,16 @@
"Location": {
"Ref": "PipelineArtifactsBucket22248F97"
},
"Type": "S3"
"Type": "S3",
"EncryptionKey": {
"Id": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"Type": "KMS"
}
}
},
"DependsOn": [
Expand Down Expand Up @@ -342,4 +450,4 @@
}
}
}
}
}
184 changes: 181 additions & 3 deletions ...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
View file
Original file line number Diff line number Diff line change
@@ -1,8 +1,129 @@
{
"Resources": {
"PipelineArtifactsBucketEncryptionKey01D58D69": {
"Type": "AWS::KMS::Key",
"DeletionPolicy": "Retain",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CdkBuildProjectRoleE0B6FEB0",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"LambdaBuildProjectRoleD0C4F982",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
}
},
"PipelineArtifactsBucket22248F97": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
"DeletionPolicy": "Retain",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"KMSMasterKeyID": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"SSEAlgorithm": "aws:kms"
}
}
]
}
}
},
"PipelineRoleD68726F7": {
"Type": "AWS::IAM::Role",
Expand Down Expand Up @@ -69,6 +190,22 @@
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
},
{
"Action": [
"codecommit:GetBranch",
Expand Down Expand Up @@ -346,7 +483,16 @@
"Location": {
"Ref": "PipelineArtifactsBucket22248F97"
},
"Type": "S3"
"Type": "S3",
"EncryptionKey": {
"Id": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"Type": "KMS"
}
}
},
"DependsOn": [
Expand Down Expand Up @@ -737,6 +883,22 @@
]
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -894,6 +1056,22 @@
]
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -931,4 +1109,4 @@
}
}
}
}
}
Loading

0 comments on commit f8f90b7

Please sign in to comment.