Skip to content

Commit

Permalink
feat(s3): default to KMS if encryptionKey is specified (#2719)
Browse files Browse the repository at this point in the history
If `encryptionKey` is specified, defaults to KMS encryption.

Fixes #2714
  • Loading branch information
Elad Ben-Israel authored Jun 3, 2019
1 parent 0593d51 commit ae4a04f
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 3 deletions.
9 changes: 6 additions & 3 deletions packages/@aws-cdk/aws-s3/lib/bucket.ts
Original file line number Diff line number Diff line change
Expand Up @@ -604,7 +604,7 @@ export interface BucketProps {
* If you choose KMS, you can specify a KMS key via `encryptionKey`. If
* encryption key is not specified, a key will automatically be created.
*
* @default BucketEncryption.Unencrypted
* @default - `Kms` if `encryptionKey` is specified, or `Unencrypted` otherwise.
*/
readonly encryption?: BucketEncryption;

Expand Down Expand Up @@ -934,8 +934,11 @@ export class Bucket extends BucketBase {
encryptionKey?: kms.IKey
} {

// default to unencrypted.
const encryptionType = props.encryption || BucketEncryption.Unencrypted;
// default based on whether encryptionKey is specified
let encryptionType = props.encryption;
if (encryptionType === undefined) {
encryptionType = props.encryptionKey ? BucketEncryption.Kms : BucketEncryption.Unencrypted;
}

// if encryption key is set, encryption must be set to KMS.
if (encryptionType !== BucketEncryption.Kms && props.encryptionKey) {
Expand Down
10 changes: 10 additions & 0 deletions packages/@aws-cdk/aws-s3/test/test.bucket.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1370,4 +1370,14 @@ export = {
});
test.done();
},

'if a kms key is specified, it implies bucket is encrypted with kms (dah)'(test: Test) {
// GIVEN
const stack = new Stack();
const key = new kms.Key(stack, 'k');

// THEN
new Bucket(stack, 'b', { encryptionKey: key });
test.done();
}
};

0 comments on commit ae4a04f

Please sign in to comment.