aws-logs: KMS Policy Not Updated When Using KMS CMK
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
From reading the [docs](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_logs-readme.html#encrypting-log-groups), using a KMS CMK with a Log Group should involve just passing the key to the Log Group. However, when doing that alone, KMS lacks the required permission to interact with Logs.
### Expected Behavior
For the `LogGroup` Construct to automatically set the required permissions to interact with KMS when a KMS CMK key is passed to it.
### Current Behavior
```
12:58:26 PM | CREATE_FAILED | AWS::Logs::LogGroup | logs00112233
Resource handler returned message: "The specified KMS key does not exist or is not allowed to be used with Arn 'arn:aws:logs:us-east-1:112233445566:log-group:PythonStack-logs00112233-AABBCCDDEEFF' (Service: CloudWatchLogs, Status Code: 400, Request <...>. HandlerErrorCode: GeneralServiceException)
```
### Reproduction Steps
```
from aws_cdk import (
Stack,
aws_kms as kms,
aws_logs as logs,
)
from constructs import Construct
class PythonStack(Stack):
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)
key = kms.Key(self, "key")
log_group = logs.LogGroup(self, "logs", encryption_key=key)
```
### Possible Solution
When passing a KMS CMK to a `LogGroup`, automatically grant the necessary permissions to the `logs.amazonaws.com` Service Principal.
### Additional Information/Context
_No response_
### CDK CLI Version
2.114.1
### Framework Version
_No response_
### Node.js Version
18.16.0
### OS
Mac
### Language
Python
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start at the aws_logs LogGroup construct and inspect how an encryption_key is handled when the construct is created. Reproduce the failure with the Python example, then run the relevant aws_logs tests. Done means a LogGroup using a KMS CMK grants the required CloudWatch Logs permissions and can be created successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100