aws / aws/aws-cdk

CDKPipelines: In cross-region stacks KMS alias does not follow the pattern alias/codepipeline*

Open
#20,677 4 comments 0 reactions 1 assignee Claimed by @rix0rrr View on GitHub
@aws-cdk/pipelines effort/small feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Hi, in a single region deployment I have a CodeDeploy action implementing a Step and using files from an artifact. The CodeDeploy action will Decrypt the codepipeline artifact on S3 using the KMS key with alias alias/codepipeline*.

In a cross-region scenario another KMS key gets created in another region. This KMS key has an alias that does not follow the pattern alias/codepipeline*.

This makes it hard to work with CDKPipelines and create a CodeDeploy execution role that has an IAM Decrypt statement with a condition allowing to use KMS keys based on a range of aliases like the clause below:
```
"Condition": {
"ForAnyValue:StringLike": {
"kms:ResourceAliases": "alias/codepipeline*"
}
}
```

### Expected Behavior

In cross-region deployments, the KMS keys associated with the artifact that gets moved to the target region should have aliases following the standard alias/codepipeline*

### Current Behavior

A generic alias that doesn't seem to follow any standard is created.

### Reproduction Steps

Anything that is deployed using cross account stack and CodeDeploy. When CodeDeploy tried to Decrypt the artifact from S3 it would need to use a KMS key that has a different alias prefix than alias/codepipeline*

### Possible Solution

Standardize the KMS aliases using alias/codepipeline* which seems to be the actual standard.

### Additional Information/Context

N/A

### CDK CLI Version

2.20.0

### Framework Version

N/A

### Node.js Version

v

### OS

AmazonLinux

### Language

Java

### Language Version

Java(8)

### Other information

It would be great if all CDKPipelines KMS keys came with standard alias prefixes as in alias/codepipeline* or at least for the scenario described above..

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.