aws / aws/aws-cdk

aws-logs: KMS Policy Not Updated When Using KMS CMK

Open
#28,304 5 comments 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-logs bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

From reading the [docs](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_logs-readme.html#encrypting-log-groups), using a KMS CMK with a Log Group should involve just passing the key to the Log Group. However, when doing that alone, KMS lacks the required permission to interact with Logs.

### Expected Behavior

For the `LogGroup` Construct to automatically set the required permissions to interact with KMS when a KMS CMK key is passed to it.

### Current Behavior

```
12:58:26 PM | CREATE_FAILED | AWS::Logs::LogGroup | logs00112233
Resource handler returned message: "The specified KMS key does not exist or is not allowed to be used with Arn 'arn:aws:logs:us-east-1:112233445566:log-group:PythonStack-logs00112233-AABBCCDDEEFF' (Service: CloudWatchLogs, Status Code: 400, Request <...>. HandlerErrorCode: GeneralServiceException)
```

### Reproduction Steps

```
from aws_cdk import (
Stack,
aws_kms as kms,
aws_logs as logs,
)
from constructs import Construct

class PythonStack(Stack):
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)

key = kms.Key(self, "key")

log_group = logs.LogGroup(self, "logs", encryption_key=key)
```

### Possible Solution

When passing a KMS CMK to a `LogGroup`, automatically grant the necessary permissions to the `logs.amazonaws.com` Service Principal.

### Additional Information/Context

_No response_

### CDK CLI Version

2.114.1

### Framework Version

_No response_

### Node.js Version

18.16.0

### OS

Mac

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the aws_logs LogGroup construct and inspect how an encryption_key is handled when the construct is created. Reproduce the failure with the Python example, then run the relevant aws_logs tests. Done means a LogGroup using a KMS CMK grants the required CloudWatch Logs permissions and can be created successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.