[aws-elasticsearch] Elastic search domain resource lacks permissions.

Elastic search domain resource lacks permissions.

Failed to create resource. Error in Accessing KmsKeyID with details:User: arn:aws:sts::<ID>:assumed-role/Testing-Mi-Main-Stack-<ID>-<ID>/Testing-Mi-Main-Stack-<ID>-<ID> is not authorized to perform: kms:DescribeKey on resource: arn:aws:kms:eu-central-1:<ID>:key/<ID> (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: <ID>; Proxy: null)

Reproduction Steps

Create elastic search Domain. (from aws_cdk.aws_elasticsearch import Domain).

What did you expect to happen?

Domain created.

What actually happened?

CloudFormation error complaining about permissions:

Failed to create resource. Error in Accessing KmsKeyID with details:User: arn:aws:sts::<ID>:assumed-role/Testing-Mi-Main-Stack-<ID>-<ID>/Testing-Mi-Main-Stack-<ID>-<ID> is not authorized to perform: kms:DescribeKey on resource: arn:aws:kms:eu-central-1:<ID>:key/<ID> (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: <ID>; Proxy: null)

Environment

• CDK CLI Version : 1.72.0
• Framework Version: 1.72.0
• Node.js Version: v15.1.0 -->
• OS : MacOS
• Language (Version): Python3.9

Other

The bug seems to be new. Did not experience in previous versions.

---

This is 🐛 Bug Report

[iliapolo]

It seems that in some, still unknown, conditions, the es:updateElasticsearchDomainConfig invoked by the ElasticsearchAccessPolicy requires the kms:DescribeKey permission on the key.

I’m reluctant to add this by default while its still unclear, but to get around this issue you can add the necessary permissions like so:

import * as cr from '@aws-cdk/custom-resources';

const key = new kms.Key(...);
const domain = new elastic.Domain(...);
const policyHandler = domain.node.tryFindChild('ESAccessPolicy') as cr.AwsCustomResource;

policyHandler.grantPrincipal.addToPrincipalPolicy(new iam.PolicyStatement({
  actions: ['kms:DescribeKey'],
  resources: [key.keyArn],
  effect: iam.Effect.ALLOW,
}))

@Ruben-E this still doesn’t explain why the same problem is happening in your case where only the L1 is being used.

[iliapolo]

@Ruben-E @ignaloidas @laimonassutkus managed to reproduce, thanks for all the cooperation 😃