Skip to content

Commit

Permalink
feat(codepipeline): make the default CodePipeline Bucket have an encr…
Browse files Browse the repository at this point in the history
…yption key (aws#2241)

This is a prerequisite for having a nice cross-account experience
(see aws#1924).
  • Loading branch information
skinny85 authored and SanderKnape committed May 14, 2019
1 parent 9b83e78 commit 274bf2b
Show file tree
Hide file tree
Showing 12 changed files with 1,314 additions and 23 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,92 @@
"Triggers": []
}
},
"PipelineArtifactsBucketEncryptionKey01D58D69" : {
"Type": "AWS::KMS::Key",
"DeletionPolicy": "Retain",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
}
},
"PipelineArtifactsBucket22248F97": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
"DeletionPolicy": "Retain",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"KMSMasterKeyID": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"SSEAlgorithm": "aws:kms"
}
}
]
}
}
},
"PipelineRoleD68726F7": {
"Type": "AWS::IAM::Role",
Expand Down Expand Up @@ -76,6 +159,22 @@
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
},
{
"Action": [
"codecommit:GetBranch",
Expand Down Expand Up @@ -285,7 +384,16 @@
"Location": {
"Ref": "PipelineArtifactsBucket22248F97"
},
"Type": "S3"
"Type": "S3",
"EncryptionKey": {
"Id": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"Type": "KMS"
}
}
},
"DependsOn": [
Expand Down Expand Up @@ -342,4 +450,4 @@
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -1,8 +1,129 @@
{
"Resources": {
"PipelineArtifactsBucketEncryptionKey01D58D69": {
"Type": "AWS::KMS::Key",
"DeletionPolicy": "Retain",
"Properties": {
"KeyPolicy": {
"Statement": [
{
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"PipelineRoleD68726F7",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CdkBuildProjectRoleE0B6FEB0",
"Arn"
]
}
},
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"LambdaBuildProjectRoleD0C4F982",
"Arn"
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
}
},
"PipelineArtifactsBucket22248F97": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
"DeletionPolicy": "Retain",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"KMSMasterKeyID": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"SSEAlgorithm": "aws:kms"
}
}
]
}
}
},
"PipelineRoleD68726F7": {
"Type": "AWS::IAM::Role",
Expand Down Expand Up @@ -69,6 +190,22 @@
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
},
{
"Action": [
"codecommit:GetBranch",
Expand Down Expand Up @@ -346,7 +483,16 @@
"Location": {
"Ref": "PipelineArtifactsBucket22248F97"
},
"Type": "S3"
"Type": "S3",
"EncryptionKey": {
"Id": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
},
"Type": "KMS"
}
}
},
"DependsOn": [
Expand Down Expand Up @@ -737,6 +883,22 @@
]
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -894,6 +1056,22 @@
]
}
]
},
{
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineArtifactsBucketEncryptionKey01D58D69",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down
Loading

0 comments on commit 274bf2b

Please sign in to comment.