search

aws-cloudformation / aws-cloudformation-resource-providers-kms

AWS Key Management Service (KMS) makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications. AWS KMS is a secure and resilient service that uses hardware security modules that have been validated under FIPS 140-2, or are in the process of being validated, to protect your keys. AWS KMS is integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.
https://aws.amazon.com/kms/
Apache License 2.0
14 stars 12 forks source link

Temporarily remove KeyUsage from createOnlyProperties to prevent key … #25

Closed jtcul closed 4 years ago

jtcul commented 4 years ago

…re-creation

Issue #, if available:

N/A

Description of changes:

Temporarily remove KeyUsage from createOnlyProperties. This will prevent keys from being re-created when their templates are updated from an unspecified (default) KeyUsage to an explicitly specified default KeyUsage. Example:

Original Template:

Resources:
  KeyResource:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: 2012-10-17
        Id: key-default
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Ref 'AWS::AccountId'
            Action: 'kms:*'
            Resource: '*'
Outputs:
  KeyId:
    Value: !Ref KeyResource

Updated Template:

Resources:
  KeyResource:
    Type: AWS::KMS::Key
    Properties:
      KeyUsage: ENCRYPT_DECRYPT
      KeyPolicy:
        Version: 2012-10-17
        Id: key-default
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Ref 'AWS::AccountId'
            Action: 'kms:*'
            Resource: '*'
Outputs:
  KeyId:
    Value: !Ref KeyResource

This fix is temporary and only works because there is only one valid KeyUsage value, A more permanent fix will be included with asymmetric support (#24).

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.