Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency #31227

samson-keung · 2024-08-27T06:11:03Z

Making the KMS key policy to use wildcard instead on the distribution id part instead of referencing the Distribution resource to get the exact distribution ID. This breaks the circular dependency in the template.

…sControl plus unit tests

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

samson-keung · 2024-08-27T06:14:20Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

@@ -84,15 +110,8 @@ export abstract class S3BucketOrigin extends cloudfront.OriginBase {
        }

        if (bucket.encryptionKey) {
-          let bucketName = bucket.bucketName;
-          if (Token.isUnresolved(bucket.bucketName)) {


Removed this because turns out bucket.bucketName is always unresolved as it returns CFN reference to the bucket (i.e. !Ref bucket). It is set here.

xazhao · 2024-08-27T21:18:19Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

+          }
+
+          if (!bucketName) {
+            throw new Error(`Cannot assemble static DomainName as bucket ${bucket.node.id} has no bucketName set.`);


I see it's getting the bucket name using

${(bucket.node.defaultChild as CfnBucket).bucketName}

at Line 132. Do we still need to check Token.isUnresolved(bucket.bucketName)?

Good catch! We do. Thank you.

I will cache the bucketName in the class and reuse it at Line 132.

I will change this PR to Draft as well since this approach is pending security discussion.

samson-keung · 2024-08-28T19:17:46Z

packages/aws-cdk-lib/aws-cloudfront-origins/test/s3-bucket-origin.test.ts

@@ -165,6 +166,221 @@ describe('S3BucketOrigin', () => {
      });
    });

+    describe('when using bucket with KMS Customer Managed key', () => {
+      it('should match expected template resource', () => {


One more unit test is needed to test escape hatch. PR to come

gracelu0 · 2024-08-28T20:15:05Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

              },
            },
          },
        );
+        Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicy',


Suggested change

Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicy',

Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicyForOac',

gracelu0 · 2024-08-28T20:22:12Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

          Annotations.of(scope).addInfo(
-            `Granting OAC permissions to access KMS key for S3 bucket origin ${bucketName} may cause a circular dependency error when this stack deploys.\n` +
+            `Granting OAC permissions to access KMS key for S3 bucket origin ${bucket.node.id} may cause a circular dependency error when this stack deploys.\n` +
            'The key policy references the distribution\'s id, the distribution references the bucket, and the bucket references the key.\n'+
            'See the "Using OAC for a SSE-KMS encrypted S3 origin" section in the module README for more details.\n',
          );


Do we still need this info message or can we combine it with the warning about wildcard? Since with the wildcard policy they most likely will not run into the circular dependency error.

Suggested a warning message below which combines the two.

Agree this message should not be needed anymore. I have removed it in the latest commit. Also updated the other warning to capture the info in your suggest warning message.

gracelu0 · 2024-08-28T20:34:23Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

              },
            },
          },
        );
+        Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicy',
+          'Using wildcard to match all Distribution IDs in Key policy condition.\n' +


Suggested change

'Using wildcard to match all Distribution IDs in Key policy condition.\n' +

`A wildcard is used to grant OAC permissions for the KMS key access to the S3 bucket origin ${bucket.node.id} to resolve a circular dependency between the key policy, distribution, and bucket.\n` +

'To follow best security practices and avoid unintended access, do not rely on this default.\n' +

'Instead, you scope down the policy condition to the specific distribution. Refer to the "Using OAC for a SSE-KMS encrypted S3 origin" section in the module README for guidance.'

gracelu0

LGTM, thank you!

aws-cdk-automation · 2024-08-28T22:12:20Z

The pull request linter fails with the following errors:

❌ The title of this pull request does not follow the Conventional Commits format, see https://www.conventionalcommits.org/.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

github-actions · 2024-08-28T22:14:32Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

introduce assembleDomainName option in S3BucketOrigin.withOriginAcces…

b08605e

…sControl plus unit tests

samson-keung requested a review from gracelu0 August 27, 2024 06:11

github-actions bot added the p2 label Aug 27, 2024

aws-cdk-automation requested a review from a team August 27, 2024 06:11

mergify bot added the contribution/core This is a PR that came from AWS. label Aug 27, 2024

aws-cdk-automation requested changes Aug 27, 2024

View reviewed changes

samson-keung commented Aug 27, 2024

View reviewed changes

xazhao reviewed Aug 27, 2024

View reviewed changes

samson-keung marked this pull request as draft August 27, 2024 23:22

samson-keung added 2 commits August 27, 2024 16:30

fix using imported bucket with assembleDomainName to true

f5c308c

remove assembleDomainName and use wildcard key policy

626a8b3

samson-keung commented Aug 28, 2024

View reviewed changes

samson-keung changed the title ~~Introduce assembleDomainName option in S3BucketOrigin.withOriginAccessControl~~ Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency Aug 28, 2024

samson-keung marked this pull request as ready for review August 28, 2024 19:20

samson-keung added 2 commits August 28, 2024 12:58

warn user about wildcard in key policy

4a8f9c8

warning wording update

9449c3c

gracelu0 requested changes Aug 28, 2024

View reviewed changes

warning wording update and removed redundant warning

dd11f45

gracelu0 approved these changes Aug 28, 2024

View reviewed changes

gracelu0 merged commit c8eaa3e into aws:gracelu0/s3-oac-l2 Aug 28, 2024
7 of 8 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Aug 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency #31227

Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency #31227

samson-keung commented Aug 27, 2024 •

edited

Loading

aws-cdk-automation left a comment

samson-keung Aug 27, 2024

xazhao Aug 27, 2024

samson-keung Aug 27, 2024

samson-keung Aug 28, 2024

gracelu0 Aug 28, 2024

gracelu0 Aug 28, 2024

gracelu0 Aug 28, 2024

samson-keung Aug 28, 2024

gracelu0 Aug 28, 2024

gracelu0 left a comment

aws-cdk-automation commented Aug 28, 2024

github-actions bot commented Aug 28, 2024

	Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicy',
	Annotations.of(key.node.scope!).addWarningV2('@aws-cdk/aws-cloudfront-origins:wildcardKeyPolicyForOac',

-          'Using wildcard to match all Distribution IDs in Key policy condition.\n' +
+          `A wildcard is used to grant OAC permissions for the KMS key access to the S3 bucket origin ${bucket.node.id} to resolve a circular dependency between the key policy, distribution, and bucket.\n` +
+          'To follow best security practices and avoid unintended access, do not rely on this default.\n' +
+          'Instead, you scope down the policy condition to the specific distribution. Refer to the "Using OAC for a SSE-KMS encrypted S3 origin" section in the module README for guidance.'

Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency #31227

Use wildcard in KMS key policy instead of referencing Distribution to avoid circular dependency #31227

Conversation

samson-keung commented Aug 27, 2024 • edited Loading

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gracelu0 left a comment

Choose a reason for hiding this comment

aws-cdk-automation commented Aug 28, 2024

github-actions bot commented Aug 28, 2024

samson-keung commented Aug 27, 2024 •

edited

Loading