5

I'm working with CDK, but I assume the same issues will happen (and hopefully can be solved) with pure CloudFormation

I'm creating an S3 bucket with a KMS key some like that:

key = aws_kms.Key(self, id="MasterKey"...)
bucket = aws_s3.Bucket(..., encryption_key=key, ...)

Then, i'm trying to tighten the policy, by adding a Deny on anything which isn't using the bucket policy, like this, as suggested is this aws blog (this isn't for KMS, but for an S3 bucket, but the idea is the same) like so:

key_policy = iam.PolicyStatement(
    actions=["kms:Encrypt"],
    effect=iam.Effect.DENY,
    resources=['*'],  # In a key policy, "*" means "this CMK"
    principals=[iam.ServicePrincipal(service="*")],
    conditions={
        "StringNotLike": {
            "aws:userId": f"{bucket_role_id}:*",
        },
    }
)

key.add_to_resource_policy(key_policy)

When I try to deploy I get a circular dependency error, which makes sense, because S3 creation needs KMS and KMS creation uses the policy that uses the S3 role id.

Is there a way to solve this problem (without resorting to using boto3 after the fact or something similar)? is this a CDK thing, or a CloudFormation issue? I would imagine that if we could update resources during deployment, but after the resource is deployed, then this could work.

Thanks for your help.

1
  • This probably won't help your use case, but in a Cloudformation template, I just comment out one of the dependencies when I run it the first time. Then when the resources are created, I paste in the hard-coded ARN for whatever dependency was missing, and run the template again, and that resource will get updated. For resources that are not regularly created and deleted, this works fine for us. Jul 5, 2021 at 17:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.