fix(events): EventBus.archive() does not forward kmsKey to Archive construct#38283
fix(events): EventBus.archive() does not forward kmsKey to Archive construct#38283markbecker7 wants to merge 2 commits into
Conversation
|
PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like |
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter fails with the following errors:
❌ Fixes must contain a change to an integration test file and the resulting snapshot.
❌ The first word of the pull request title should not be capitalized. If the title starts with a CDK construct, it should be in backticks "``".
If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.
|
Comments on closed issues and PRs are hard for our team to see. |
Reason for this change
The EventBus.archive() method accepts a kmsKey parameter in its props argument, but was not forwarding this parameter to the underlying Archive construct. This prevented users from encrypting EventBridge archives using customer-managed KMS keys even when they explicitly specified the kmsKey prop.
Description of changes
Modified the EventBus.archive() method in packages/aws-cdk-lib/aws-events/lib/event-bus.ts to forward the kmsKey property from BaseArchiveProps to the Archive constructor:
kmsKey: props.kmsKey,This one-line change ensures that when users provide a KMS key for encryption, it is properly passed through to the underlying Archive construct, allowing customer-managed KMS encryption to work as originally intended.
Describe any new or updated permissions being added
No new permissions are being added. This change enables the use of existing kms:Decrypt and kms:GenerateDataKey permissions that users would already have if they use customer-managed KMS keys for other AWS services.
Description of how you validated changes
Added a new unit test to test that the archive forwards the kmsKey to the underlying Archive construct, which verifies the kmsKey parameter is properly forwarded to the underlying Archive construct and that KmsKeyIdentifier is correctly set on the CloudFormation Archive resource. All existing tests continue to pass.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license