[sqs] Circular dependency between resources when encrypting sqs queue with kms and assigning target to rule

I am setting up an event bridge rule that will forward events from Macie to sqs. Everything works fine until I add encryptionMasterKey to the queue. I either have to remove the .encryptionMasterKey or remove the .target() to avoid circular dependency error.

Reproduction Steps

val queue = Queue.Builder.create(scope, "MacieReportQueue")
             .queueName("MacieReportQueue")
             // TODO: FIXME: KMS Circular dependency error when combined with target
             //  https://github.com/aws/aws-cdk/issues/3067
             .encryption(QueueEncryption.KMS)
             .encryptionMasterKey(key)
             .build()

     val target = SqsQueue.Builder.create(queue).build()

     val rule = Rule.Builder.create(scope, "MacieToSqsEventBridgeRule")
             .ruleName("MacieToSqsEventBridgeRule")
             .description("Sends messages to SQS if Macie finds sensitive information")
             .targets(listOf(target))
             .eventPattern(EventPattern.builder()
                     .source(listOf("aws.macie"))
                     .build()
             )
             .build()

CF Graph

What did you expect to happen?

No circular dependency error. Queue should be encrypted.

What actually happened?

Circular dependency between resources: [MacieReportQueue7D1A954B, MacieReportQueuePolicy84D89C73, MacieToSqsEventBridgeRule498CF606, MacieReportQueueKeyAliasA0A0C899, MacieReportQueueKeyF608AAD8]

Environment

• **CLI Version :1.67.0 (build 2b4dd71)
• **Framework Version:1.67.0
• Node.js Version: v14.13.1
• OS : Mac 10.14.6
• Language (Version): Java 8

Other

---

This is 🐛 Bug Report

[sudopla]

I’m using the CFN class to circumvent this problem for now.

const cfnRule = eventRule.node.defaultChild as events.CfnRule
cfnRule.targets = [
    {
        arn: queue.queueArn,
        id: 'EventQueue-Target',
    }
]

You will also need to define the following permissions

// Gives EventBridge rule permission to send message to queue target            
queue.addToResourcePolicy(new iam.PolicyStatement({
    actions: ['sqs:SendMessage'],
    resources: [queue.queueArn],
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    conditions: {
        'ArnEquals': {'aws:SourceArn': eventRule.ruleArn}
    }
}))

// Give EventBridge access to KMS key
sqsKmsKey.addToResourcePolicy(new iam.PolicyStatement({
    principals: [new iam.ServicePrincipal('events.amazonaws.com')],
    actions: ['kms:Decrypt', 'kms:GenerateDataKey'],
    resources: ['*']
}))

[madeline-k]

Taking a look at this one. I’m planning to remove the condition from being added here: https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-events-targets/lib/sqs.ts#L58-L60 in the case where the queue is encrypted.