fix(events-targets): kinesis Stream target with Customer-Managed KMS key causes EventBridge FailedInvocations

[xazhao]

Issue # (if applicable)

Closes #10996.

Reason for this change

When a Kinesis Stream is encrypted with a custom managed KMS key, CDK will generate a KMS key for the Kinesis Stream.

stream = new kinesis.Stream(stack, 'MyStream', {
  encryption: kinesis.StreamEncryption.KMS,
});

If it is used as a events target, CDK will provide permissions to the role of target so it can write to the kinesis stream:

{
     Action: ['kinesis:PutRecord', 'kinesis:PutRecords'],
     Effect: 'Allow',
     Resource: streamArn,
}

If the kinesis is not encrypted with the customer managed kms key, these permissions will be sufficient. However, since the kinesis is encrypted with the the customer managed kms key, the invocation will fail because events doesn't have the permissions to the KMS key.

Actually there's already grantWrite() method to grant sufficient permissions in this case. When a customer managed KMS key is used, it will generate extra policies for the key. We should use it.

aws-cdk/packages/aws-cdk-lib/aws-kinesis/lib/stream.ts

Line 355 in 366b492

public grantWrite(grantee: iam.IGrantable) {

Difference:

these permissions will be added to the event

{
     Action: ['kinesis:ListShards(new permission)', 'kinesis:PutRecord', 'kinesis:PutRecords'],
     Effect: 'Allow',
     Resource: streamArn,
}

these permissions will be added to the event if the target kinesis stream is using a customer managed KMS key

{
    Action: ['kms:Encrypt', 'kms:ReEncrypt*', 'kms:GenerateDataKey*'],
    Effect: 'Allow',
    Resource: streamKeyArn,
},

Description of changes

Use the existing grantWrite() method instead of manipulating IAM policies directly.

Description of how you validated changes

unit tests/integration tests

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: c85a454
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.