(bootstrap) FilePublishingRoleDefaultPolicy permission incorrect when FileAssetsBucketKmsKeyId is an ARN value
Open
bug
p2
- Dominant language
- TypeScript
- Stars
- 105
- Forks
- 122
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 71
Description
We use a cross-account KMS key to encrypt CDK S3 buckets. When the ARN for this key is provided as the FileAssetsBucketKmsKeyId parameter value, the template generates an invalid policy statement. The parameter description notes that this can be either a KMS key ID or ARN value.
https://github.com/aws/aws-cdk-cli/blob/a560d1e6a0bab88ae1716296d946aab8755a340f/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L542
Contributor guide
Assessment
This issue has not been assessed yet.