aws-codepipeline: Only supports KMS but not KMS_MANAGED

aws-codepipeline fails if I use the CdKPipeline with provisioning its own bucket and with active cross account and KMS_MANAGED. Those lines are the culprit:

   // if we have a cross-account action, the pipeline's bucket must have a KMS key
    // (otherwise we can't configure cross-account trust policies)
    if (action.isCrossAccount) {
      const artifactBucket = this.ensureReplicationResourcesExistFor(action).artifactBucket;
      if (!artifactBucket.encryptionKey) {
        throw new Error(
          `Artifact Bucket must have a KMS Key to add cross-account action '${action.actionProperties.actionName}' ` +
          `(pipeline account: '${renderEnvDimension(this.env.account)}', action account: '${renderEnvDimension(action.effectiveAccount)}'). ` +
          'Create Pipeline with \'crossAccountKeys: true\' (or pass an existing Bucket with a key)',

it states clear the we need to use KMS. But with using the property artifactBucket.encryptionKey you only can validate that you are using KMS with an external key. It doesn’t support KMS_MANAGED this way. The underlying issue is might that the property encryptionKey is null when using KMS_MANAGED.

So I suggest to not letting it be null or changing the if statement + an optional read property for the bucket to get which encryption is used.

I created a draft PR: https://github.com/aws/aws-cdk/pull/13028 . If you like it I will continue with it and implement the new encryption property.

Reproduction Steps

const sourceBucket = new s3.Bucket(this, 'PipeBucket', {
      removalPolicy: core.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
      versioned: true,
      encryption: s3.BucketEncryption.KMS_MANAGED,
    });

    const pipeline = new Pipeline(this, 'Pipeline', {
      artifactBucket: sourceBucket,
      restartExecutionOnUpdate: true,
    });

    const sourceArtifact = new Artifact();
    const cloudAssemblyArtifact = new Artifact();

    const cdkPipeline = new CdkPipeline(this, 'CdkPipeline', {
      // The pipeline name
      // pipelineName: `${this.stackName}-pipeline`,
      cloudAssemblyArtifact,
      codePipeline: pipeline,
      // crossAccountKeys: true,

      // Where the source can be found
      sourceAction: repo,
      ...

What did you expect to happen?

No error

What actually happened?

cdk deploy throws “Artifact Bucket must have a KMS Key to add cross-account action …”

Environment

• CDK CLI Version :
• Framework Version:
• Node.js Version:
• OS :
• Language (Version):

Other

---

This is 🐛 Bug Report

[QuinnyPig]

So few things make me happy, but this would indeed please me.

[skinny85]

Sorry, I don’t understand 😜.

You said:

@skinny85 Adding if (build.role) artifactBucket.grantReadWrite(build.role) has fixed it! Thank you for the tip.

But then the code that you have that you said works does not have if (build.role) artifactBucket.grantReadWrite(build.role) anywhere:

const artifactBucket = new s3.Bucket(this, 'CodePipelineArtifactsBucket', {
  encryption: s3.BucketEncryption.KMS_MANAGED, // to prevent creating KMS keys (they cost money)
  removalPolicy: RemovalPolicy.DESTROY,
})
const build = new codebuild.PipelineProject(this, 'CodeBuildProject', { /* props */ })
build.addToRolePolicy(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['s3:PutObject*'],
    resources: [artifactBucket.arnForObjects('*')],
  })
)
new codepipeline.Pipeline(this, 'CodePipeline', {
  artifactBucket,
  // .... other props
{
  stageName: 'Build',
  actions: [
    new actions.CodeBuildAction({
      actionName: 'CodeBuild',
      project: build,
      input: sourceOutput,
      outputs: [buildOutput],
    }),
  ],
},
}

So… which one is it? 😜