(secretsmanager ): grant_read/grant_write on secret throws KMS key error on role from same account
See original GitHub issueGiving a preexisting role read/write access to a secret using the grant_read/grant_write method on a secret throws the error: “KMS Key must be provided for cross account access to Secret” Even though both secret and role are from the same AWS account.
Reproduction Steps
Use an existing role and create a new secret Give it read/write access
from aws_cdk import (
aws_iam as iam,
aws_secretsmanager as secretsmanager,
core
)
class Stack(core.Stack):
role = iam.Role.from_role_arn(self, "role", <existing iam role>)
secret = secretsmanager.Secret(
scope=self,
id="secret-id",
description='secret desc'
)
secret.grant_read(role)
secret.grant_write(role)
app = core.App()
Stack(app, "SecretKMSError")
app.synth()
What did you expect to happen?
I expect the created secret to be created with read and write rights added to the existing role.
What actually happened?
CDK deploy throws an error: KMS Key must be provided for cross account access to Secret Even though both the (pre-existing) and the secret are on the same AWS account
Environment
- CDK CLI Version : 1.111.0
- Framework Version: 1.111.0
- Node.js Version: v12.20.1
- OS : Windows 10
- Language (Version): Python (3.8)
Other
This worked before version 1.111.0
Workaround:
role.add_to_policy(iam.PolicyStatement(effect=iam.Effect.ALLOW, actions=['secretsmanager:PutSecretValue', 'secretsmanager:UpdateSecret', 'secretsmanager:GetSecretValue', 'secretsmanager:DescribeSecret'], resources=[secret._arn_for_policies]))
I think it was introduced by this commit: https://github.com/aws/aws-cdk/commit/ea40cfe1b85ce4aee9c8f871de08d3c3739589d1
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 2 years ago
- Reactions:5
- Comments:7 (4 by maintainers)
This can be closed was fixed in https://github.com/aws/aws-cdk/releases/tag/v1.140.0
@nwouda and @mooiweer if either of you are interesting in fixing this yourself, please take a look at the contributing guide.