fix(events-targets): remove circular dependency when adding an SQS Qu…

…eue encrypted with KMS as a target of an AWS Events Rule fixes aws#11158
madeline-k · May 11, 2021 · fab4704 · fab4704
1 parent 256fd4c
commit fab4704
Show file tree

Hide file tree

Showing 4 changed files with 76 additions and 17 deletions.
diff --git a/packages/@aws-cdk/aws-events-targets/lib/sqs.ts b/packages/@aws-cdk/aws-events-targets/lib/sqs.ts
@@ -52,14 +52,18 @@ export class SqsQueue implements events.IRuleTarget {
    * @see https://docs.aws.amazon.com/eventbridge/latest/userguide/resource-based-policies-eventbridge.html#sqs-permissions
    */
   public bind(rule: events.IRule, _id?: string): events.RuleTargetConfig {
-    // deduplicated automatically
-    this.queue.grantSendMessages(new iam.ServicePrincipal('events.amazonaws.com',
-      {
+    // Only add the rule as a condition if the queue is not encrypted, to avoid circular dependency. See issue #11158.
+    var servicePrincipalOpts:iam.ServicePrincipalOpts = {};
+    if (this.queue.encryptionMasterKey == null) {
+      servicePrincipalOpts = {
         conditions: {
           ArnEquals: { 'aws:SourceArn': rule.ruleArn },
         },
-      }),
-    );
+      };
+    }
+
+    // deduplicated automatically
+    this.queue.grantSendMessages(new iam.ServicePrincipal('events.amazonaws.com', servicePrincipalOpts));
 
     return {
       arn: this.queue.queueArn,

diff --git a/packages/@aws-cdk/aws-events-targets/package.json b/packages/@aws-cdk/aws-events-targets/package.json
@@ -93,6 +93,7 @@
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-kinesis": "0.0.0",
     "@aws-cdk/aws-kinesisfirehose": "0.0.0",
+    "@aws-cdk/aws-kms": "0.0.0",
     "@aws-cdk/aws-lambda": "0.0.0",
     "@aws-cdk/aws-logs": "0.0.0",
     "@aws-cdk/aws-sns": "0.0.0",
@@ -122,7 +123,8 @@
     "@aws-cdk/aws-stepfunctions": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/custom-resources": "0.0.0",
-    "constructs": "^3.3.69"
+    "constructs": "^3.3.69",
+    "@aws-cdk/aws-kms": "0.0.0"
   },
   "engines": {
     "node": ">= 10.13.0 <13 || >=13.7.0"

diff --git a/packages/@aws-cdk/aws-events-targets/test/sqs/integ.sqs-event-rule-target.expected.json b/packages/@aws-cdk/aws-events-targets/test/sqs/integ.sqs-event-rule-target.expected.json
@@ -1,5 +1,53 @@
 {
   "Resources": {
+    "MyKey6AB29FA6": {
+      "Type": "AWS::KMS::Key",
+      "Properties": {
+        "KeyPolicy": {
+          "Statement": [
+            {
+              "Action": "kms:*",
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":iam::",
+                      {
+                        "Ref": "AWS::AccountId"
+                      },
+                      ":root"
+                    ]
+                  ]
+                }
+              },
+              "Resource": "*"
+            },
+            {
+              "Action": [
+                "kms:Decrypt",
+                "kms:Encrypt",
+                "kms:ReEncrypt*",
+                "kms:GenerateDataKey*"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "events.amazonaws.com"
+              },
+              "Resource": "*"
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      },
+      "UpdateReplacePolicy": "Retain",
+      "DeletionPolicy": "Retain"
+    },
     "MyRuleA44AB831": {
       "Type": "AWS::Events::Rule",
       "Properties": {
@@ -20,6 +68,14 @@
     },
     "MyQueueE6CA6235": {
       "Type": "AWS::SQS::Queue",
+      "Properties": {
+        "KmsMasterKeyId": {
+          "Fn::GetAtt": [
+            "MyKey6AB29FA6",
+            "Arn"
+          ]
+        }
+      },
       "UpdateReplacePolicy": "Delete",
       "DeletionPolicy": "Delete"
     },
@@ -34,16 +90,6 @@
                 "sqs:GetQueueAttributes",
                 "sqs:GetQueueUrl"
               ],
-              "Condition": {
-                "ArnEquals": {
-                  "aws:SourceArn": {
-                    "Fn::GetAtt": [
-                      "MyRuleA44AB831",
-                      "Arn"
-                    ]
-                  }
-                }
-              },
               "Effect": "Allow",
               "Principal": {
                 "Service": "events.amazonaws.com"

diff --git a/packages/@aws-cdk/aws-events-targets/test/sqs/integ.sqs-event-rule-target.ts b/packages/@aws-cdk/aws-events-targets/test/sqs/integ.sqs-event-rule-target.ts
@@ -1,4 +1,5 @@
 import * as events from '@aws-cdk/aws-events';
+import * as kms from '@aws-cdk/aws-kms';
 import * as sqs from '@aws-cdk/aws-sqs';
 import * as cdk from '@aws-cdk/core';
 import * as targets from '../../lib';
@@ -12,11 +13,17 @@ const app = new cdk.App();
 
 const stack = new cdk.Stack(app, 'aws-cdk-sqs-event-target');
 
+const key = new kms.Key(stack, 'MyKey');
+
 const event = new events.Rule(stack, 'MyRule', {
   schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
 });
 
-const queue = new sqs.Queue(stack, 'MyQueue');
+const queue = new sqs.Queue(stack, 'MyQueue', {
+  encryption: sqs.QueueEncryption.KMS,
+  encryptionMasterKey: key,
+});
+
 event.addTarget(new targets.SqsQueue(queue));
 
 app.synth();