KMS-Managed SQS encyption generating invalid IAM policy for Lambda func

[tylerarbus]

Describe the bug

When using KMS-Managed queue encryption for SQS, the CDK is generating an invalid IAM policy when attached as an event source for a lambda function. The following error is generated in CloudFormation:

Resource alias/aws/sqs must be in ARN format or "*". (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument)

The invalid policy statement is being generated for the Lambda function ("Resource" should be an ARN or "*", but is being generated as "alias/aws/sqs"):

            {
              "Action": "kms:Decrypt",
              "Effect": "Allow",
              "Resource": "alias/aws/sqs"
            }

To Reproduce

    // Provision queue and dead letter queue in SQS
    const DLQ = new sqs.Queue(this, 'DeadLetterQueue', {
      encryption: sqs.QueueEncryption.KmsManaged,
    });

    const queue = new sqs.Queue(this, 'Queue', {
      deadLetterQueue: {
        queue: DLQ,
        maxReceiveCount: 3,
      },
      encryption: sqs.QueueEncryption.KmsManaged,
    });

    // Create  lambda function
    const lambda = new lambda.Function(this, 'Lambda', {
      code: lambda.Code.directory('lambda'),
      handler: 'index.lambda_handler',
      runtime: lambda.Runtime.Ruby25,
    });

    // Add SQS as event source to lambda function
    lambda.addEventSource(new lambdaEventSources.SqsEventSource(queue));

Expected behavior
The statement included in the Lambda IAM policy for kms:Decrypt should have a resource with a valid ARN

Version:

• OS: MacOS 10.14.5
• Programming Language: Typescript
• CDK Version: 0.33

[pepastach]

In case you encounter this problem, here's an example of a workaround:

Instead of simple CDK grant:

queue.grant_send_messages(grantee=fargate_task_definition.task_role)

You have to add a policy statement:

fargate_task_definition.task_role.add_to_policy(
    PolicyStatement(
        effect=Effect.ALLOW,
        actions=['sqs:SendMessage', 'sqs:GetQueueAttributes', 'sqs:GetQueueUrl'],
        resources=[queue.queue_arn]
    )
)
fargate_task_definition.task_role.add_to_policy(
    PolicyStatement(
        effect=Effect.ALLOW,
        actions=['kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'],
        resources=[f'arn:aws:kms:{Aws.REGION}:{Aws.ACCOUNT_ID}:alias/aws/sqs']
    )
)