CDKPipelines: In cross-region stacks KMS alias does not follow the pattern alias/codepipeline*
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Hi, in a single region deployment I have a CodeDeploy action implementing a Step and using files from an artifact. The CodeDeploy action will Decrypt the codepipeline artifact on S3 using the KMS key with alias alias/codepipeline*.
In a cross-region scenario another KMS key gets created in another region. This KMS key has an alias that does not follow the pattern alias/codepipeline*.
This makes it hard to work with CDKPipelines and create a CodeDeploy execution role that has an IAM Decrypt statement with a condition allowing to use KMS keys based on a range of aliases like the clause below:
```
"Condition": {
"ForAnyValue:StringLike": {
"kms:ResourceAliases": "alias/codepipeline*"
}
}
```
### Expected Behavior
In cross-region deployments, the KMS keys associated with the artifact that gets moved to the target region should have aliases following the standard alias/codepipeline*
### Current Behavior
A generic alias that doesn't seem to follow any standard is created.
### Reproduction Steps
Anything that is deployed using cross account stack and CodeDeploy. When CodeDeploy tried to Decrypt the artifact from S3 it would need to use a KMS key that has a different alias prefix than alias/codepipeline*
### Possible Solution
Standardize the KMS aliases using alias/codepipeline* which seems to be the actual standard.
### Additional Information/Context
N/A
### CDK CLI Version
2.20.0
### Framework Version
N/A
### Node.js Version
v
### OS
AmazonLinux
### Language
Java
### Language Version
Java(8)
### Other information
It would be great if all CDKPipelines KMS keys came with standard alias prefixes as in alias/codepipeline* or at least for the scenario described above..
Contributor guide
Assessment
This issue has not been assessed yet.