Skip to content

Commit 8c44aa7

Browse files
authored
feat(events): support customer managed key for event bus (#30493)
### Issue # (if applicable) N/A ### Reason for this change Amazon EventBridge supports Customer Managed Key for Event Bus since 2024/5. But current L2 Construct does not support CMK. For more information, see [Amazon EventBridge now supports Customer Managed Keys (CMK) for Event Buses](https://aws.amazon.com/about-aws/whats-new/2024/05/amazon-eventbridge-cmk-event-buses/?nc1=h_ls). ### Description of changes Add `kmsKey` property to the `EventBus` class ### Description of how you validated changes Add unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0baa573 commit 8c44aa7

12 files changed

+770
-0
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/eventbue-customer-managed-key.assets.json

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"Resources": {
3+
"KmsKey46693ADD": {
4+
"Type": "AWS::KMS::Key",
5+
"Properties": {
6+
"KeyPolicy": {
7+
"Statement": [
8+
{
9+
"Action": "kms:*",
10+
"Effect": "Allow",
11+
"Principal": {
12+
"AWS": {
13+
"Fn::Join": [
14+
"",
15+
[
16+
"arn:",
17+
{
18+
"Ref": "AWS::Partition"
19+
},
20+
":iam::",
21+
{
22+
"Ref": "AWS::AccountId"
23+
},
24+
":root"
25+
]
26+
]
27+
}
28+
},
29+
"Resource": "*"
30+
},
31+
{
32+
"Action": [
33+
"kms:Decrypt",
34+
"kms:DescribeKey",
35+
"kms:GenerateDataKey"
36+
],
37+
"Condition": {
38+
"StringEquals": {
39+
"aws:SourceAccount": {
40+
"Ref": "AWS::AccountId"
41+
},
42+
"aws:SourceArn": {
43+
"Fn::Join": [
44+
"",
45+
[
46+
"arn:",
47+
{
48+
"Ref": "AWS::Partition"
49+
},
50+
":events:",
51+
{
52+
"Ref": "AWS::Region"
53+
},
54+
":",
55+
{
56+
"Ref": "AWS::AccountId"
57+
},
58+
":event-bus/eventbuecustomermanagedkeyBus178EB991"
59+
]
60+
]
61+
},
62+
"kms:EncryptionContext:aws:events:event-bus:arn": {
63+
"Fn::Join": [
64+
"",
65+
[
66+
"arn:",
67+
{
68+
"Ref": "AWS::Partition"
69+
},
70+
":events:",
71+
{
72+
"Ref": "AWS::Region"
73+
},
74+
":",
75+
{
76+
"Ref": "AWS::AccountId"
77+
},
78+
":event-bus/eventbuecustomermanagedkeyBus178EB991"
79+
]
80+
]
81+
}
82+
}
83+
},
84+
"Effect": "Allow",
85+
"Principal": {
86+
"Service": "events.amazonaws.com"
87+
},
88+
"Resource": "*"
89+
}
90+
],
91+
"Version": "2012-10-17"
92+
}
93+
},
94+
"UpdateReplacePolicy": "Delete",
95+
"DeletionPolicy": "Delete"
96+
},
97+
"BusEA82B648": {
98+
"Type": "AWS::Events::EventBus",
99+
"Properties": {
100+
"KmsKeyIdentifier": {
101+
"Fn::GetAtt": [
102+
"KmsKey46693ADD",
103+
"Arn"
104+
]
105+
},
106+
"Name": "eventbuecustomermanagedkeyBus178EB991"
107+
}
108+
}
109+
},
110+
"Parameters": {
111+
"BootstrapVersion": {
112+
"Type": "AWS::SSM::Parameter::Value<String>",
113+
"Default": "/cdk-bootstrap/hnb659fds/version",
114+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
115+
}
116+
},
117+
"Rules": {
118+
"CheckBootstrapVersion": {
119+
"Assertions": [
120+
{
121+
"Assert": {
122+
"Fn::Not": [
123+
{
124+
"Fn::Contains": [
125+
[
126+
"1",
127+
"2",
128+
"3",
129+
"4",
130+
"5"
131+
],
132+
{
133+
"Ref": "BootstrapVersion"
134+
}
135+
]
136+
}
137+
]
138+
},
139+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
140+
}
141+
]
142+
}
143+
}
144+
}

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/eventbuecustomermanagedkeytestDefaultTestDeployAssertBCCA03C5.assets.json

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/eventbuecustomermanagedkeytestDefaultTestDeployAssertBCCA03C5.template.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.eventbus-customer-managed-key.js.snapshot/manifest.json

Lines changed: 119 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)