Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CodePipeline: allow alias to be assigned to autogenerated KMS key #2569

Closed
otterley opened this issue May 16, 2019 · 1 comment · Fixed by #3694
Closed

CodePipeline: allow alias to be assigned to autogenerated KMS key #2569

otterley opened this issue May 16, 2019 · 1 comment · Fixed by #3694
Assignees
@skinny85
Labels
@aws-cdk/aws-codepipeline Related to AWS CodePipeline feature-request A feature should be added or improved.

Comments

@otterley
Copy link
Contributor

otterley commented May 16, 2019 •
edited
Loading

CodePipeline pipelines created by the codepipeline.Pipeline class will automatically generate an S3 bucket to store artifacts in and a KMS key (CMK) to encrypt the objects in that bucket, if the bucket isn't specified via the artifactBucket property.

It would be helpful if one could specify an alias to assign to the autogenerated CMK so that other account users have an indication that the CMK is used for the pipeline. This could also help dissuade administrators from accidentally marking the CMK for expiration, which would render the pipeline unusable.
@otterley otterley added the feature-request A feature should be added or improved. label May 16, 2019
@skinny85 skinny85 mentioned this issue Aug 17, 2019
Merged
@skinny85
Copy link
Contributor

This is solved in #3694 by always creating an Alias for the autogenerated CodePipelineKey.

@skinny85 skinny85 added the @aws-cdk/aws-codepipeline Related to AWS CodePipeline label Aug 17, 2019
@skinny85 skinny85 self-assigned this Aug 17, 2019
skinny85 added a commit that referenced this issue Sep 11, 2019
@skinny85
feat(codepipeline): cross-environment (account+region) actions (#3694)
69bff3d 
This changes the scaffolding stack logic for the cross-region CodePipelines to include a KMS key and alias as part of it, which are required if an action is simultaneously cross-region and cross-account. We also change to use the KMS key ID instead of the key ARN when rendering the ArtifactStores property.

We also add an alias to the default pipeline artifact bucket.

This required a bunch of changes to the KMS and S3 modules:

* Alias now implements IKey
* Added the keyId property to IKey
* Added removalPolicy property to Alias
* Granting permissions to a key works if the principal belongs to a stack that is a dependent of the key stack
* Allow specifying a key when importing a bucket

Fixes #52
Concerns #1584
Fixes #2517
Fixes #2569
Concerns #3275
Fixes #3138
Fixes #3388
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@skinny85 skinny85

Labels
@aws-cdk/aws-codepipeline Related to AWS CodePipeline feature-request A feature should be added or improved.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(codepipeline): cross-environment (account+region) actions skinny85/aws-cdk
2 participants
@otterley @skinny85