search

aws-cloudformation / aws-cloudformation-resource-providers-kms

AWS Key Management Service (KMS) makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications. AWS KMS is a secure and resilient service that uses hardware security modules that have been validated under FIPS 140-2, or are in the process of being validated, to protect your keys. AWS KMS is integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.
https://aws.amazon.com/kms/
Apache License 2.0
14 stars 12 forks source link

Remove KeyPolicy default in aws-kms-key.json #63

Closed pdz8 closed 2 months ago

pdz8 commented 2 months ago

Description of changes

The default KeyPolicy in aws-kms-key.json is not a valid policy and is sometimes being inserted as a default into templates updates that specify no KeyPolicy property. This change removes the default from aws-kms-key.json. It's presence is unnecessary since there is existing documentation of the intended KeyPolicy default behavior.

Testing

Ran the following series of steps in ca-west-1 and eu-west-1 without getting any errors

cat > awskmskey-without-props <<HERE
Resources:
  KeyResource:
    Type: AWS::KMS::Key
HERE

aws --region $REGION cloudformation create-stack --stack-name P127469077-repro --template-body file://awskmskey-without-props
cat > awskmskey-with-policy <<HERE
Resources:
  KeyResource:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: 2012-10-17
        Id: key-default-1
        Statement:
          - Sid: EXPLICITLY DEFINED POLICY
            Effect: Allow
            Principal:
              AWS: !Ref 'AWS::AccountId'
            Action: 'kms:*'
            Resource: '*'
HERE

aws --region $REGION cloudformation update-stack --stack-name P127469077-repro --template-body file://awskmskey-with-policy
aws --region $REGION cloudformation update-stack --stack-name P127469077-repro --template-body file://awskmskey-without-props

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.