feat(s3tables): server-side encryption by customer managed KMS key #34229

badmintoncryer · 2025-04-23T14:17:08Z

Issue # (if applicable)

None

Reason for this change

AWS S3 Tables supports for server side encryption by customer managed KMS keys.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-encryption.html

And cloudformation have supported for this feature.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3tables-tablebucket-encryptionconfiguration.html

Description of changes

Add kmsKey prop to TableBucketProps
Add kms key resource policy which enables S3 Tables to execute automatic table maintenance
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-permissions.html

Describe any new or updated permissions being added

Add resource policy to the kms key.

// add resource policy to the encryption key
    // see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-permissions.html#tables-kms-maintenance-permissions
    props?.kmsKey?.addToResourcePolicy(
      new iam.PolicyStatement({
        actions: ['kms:Decrypt', 'kms:GenerateDataKey'],
        resources: ['*'],
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal('maintenance.s3tables.amazonaws.com')],
        conditions: {
          StringLike: {
            'kms:EncryptionContext:aws:s3:arn': `${Stack.of(this).formatArn({
              service: 's3tables',
              resource: 'bucket',
              resourceName: props.tableBucketName,
            })}/*`,
          },
        },
      }),
    );

Description of how you validated changes

Add both unit and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

badmintoncryer · 2025-04-23T14:25:50Z

packages/@aws-cdk/aws-s3tables-alpha/lib/table-bucket.ts

+    props?.kmsKey?.addToResourcePolicy(
+      new iam.PolicyStatement({
+        actions: ['kms:Decrypt', 'kms:GenerateDataKey'],
+        resources: ['*'],


While the documentation specifies using the KMS Key ARN as resource section, I am using a wildcard (*) for the following reasons:

Specifying kmsKey.keyArn as the resource would create a circular reference

In resource policies, using a wildcard (*) or specifying the key ARN has the same effect

In a key policy, the value of the Resource element is "*", which means "this KMS key." The asterisk ("*") identifies the KMS key to which the key policy is attached.

https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

QuantumNeuralCoder · 2025-05-05T17:19:53Z

packages/@aws-cdk/aws-s3tables-alpha/test/table-bucket.test.ts

+        kmsKey,
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::KMS::Key', {


Can you run the security-guardian tool locally? I am sure it will complain :). Refer README.

This is the execution result. Is it OK?

❯ yarn security-guardian yarn run v1.22.21 $ ts-node src/index.ts --rule_set_path=./rules Created working directory: ./changed_templates Detecting changed .template.json files from origin/main to HEAD [command]/opt/homebrew/bin/git diff --name-status origin/main HEAD M packages/@aws-cdk/aws-s3tables-alpha/README.md M packages/@aws-cdk/aws-s3tables-alpha/lib/table-bucket.ts M packages/@aws-cdk/aws-s3tables-alpha/rosetta/default.ts-fixture A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/cdk.out A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/integ.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kms-key-s3tables-stack.assets.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kms-key-s3tables-stack.template.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.assets.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.template.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/manifest.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/tree.json A packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.ts M packages/@aws-cdk/aws-s3tables-alpha/test/table-bucket.test.ts [command]/opt/homebrew/bin/git rev-parse --show-toplevel /Users/kazuhoshinozuka/git/aws-cdk fullpath: /Users/kazuhoshinozuka/git/aws-cdk/packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kms-key-s3tables-stack.template.json Copied: packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kms-key-s3tables-stack.template.json [command]/opt/homebrew/bin/git rev-parse --show-toplevel /Users/kazuhoshinozuka/git/aws-cdk fullpath: /Users/kazuhoshinozuka/git/aws-cdk/packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.template.json Copied: packages/@aws-cdk/aws-s3tables-alpha/test/integration/integ.table-bucket-kms-key.js.snapshot/kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.template.json Running cfn-guard with rule set: ./rules [command]/opt/homebrew/bin/cfn-guard validate --data ./changed_templates --rules ./rules --show-summary fail --output-format json { "name": "/Users/kazuhoshinozuka/git/aws-cdk/tools/@aws-cdk/security-guardian/changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kms-key-s3tables-stack.template.json", "metadata": {}, "status": "SKIP", "not_compliant": [], "not_applicable": [ "IAM_ROLE_NO_BROAD_PRINCIPALS" ], "compliant": [] }{ "name": "/Users/kazuhoshinozuka/git/aws-cdk/tools/@aws-cdk/security-guardian/changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.template.json", "metadata": {}, "status": "SKIP", "not_compliant": [], "not_applicable": [ "IAM_ROLE_NO_BROAD_PRINCIPALS" ], "compliant": [] }Running scanner for intrinsics Scanning JSON files in: ./changed_templates Processing: changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kms-key-s3tables-stack.template.json Match found in: changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kms-key-s3tables-stack.template.json (statements: 1) Processing: changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kmskeys3tablesintegDefaultTestDeployAssertC8AB8C4E.template.json detailed_output File: changed_templates/packages_@aws-cdk_aws-s3tables-alpha_test_integration_integ.table-bucket-kms-key.js.snapshot_kms-key-s3tables-stack.template.json { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } |n| ============================================================ Scan complete! Files scanned : 2 Matches found : 1 ::warning::Intrinsic scan found 1 issue(s). ::set-output name=issues_found::1 ::error::Action completed with issues: Intrinsic scan found 1 issue(s). Removed working directory: ./changed_templates error Command failed with exit code 1. info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Yes. The results are fine.

QuantumNeuralCoder

Noting the kms* pattern also caught by security guardian. Approving this.

mergify · 2025-05-09T22:24:15Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-05-09T22:54:56Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 882f81b
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-05-09T22:55:09Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-05-09T22:55:19Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

godwingrs22 · 2025-05-14T20:23:48Z

Hi @badmintoncryer,

First of all, thank you for taking the time to contribute to this feature. We truly value community contributions and the effort you put into implementing this feature.

I need to revert this PR as there was a parallel implementation #34281 being developed by the service team that includes some additional internal considerations. I apologize for not catching this overlap earlier in the review process.

Thanks for your understanding!

badmintoncryer added 2 commits April 23, 2025 22:51

support encryption configuration

0967a15

add integ test

7c13ef3

aws-cdk-automation requested a review from a team April 23, 2025 14:17

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Apr 23, 2025

badmintoncryer changed the title ~~feat(s3tables): kms key encryption~~ feat(s3tables): server-side encryption by customer managed KMS key Apr 23, 2025

aws-cdk-automation previously requested changes Apr 23, 2025

View reviewed changes

badmintoncryer commented Apr 23, 2025

View reviewed changes

add readme

7ea75cf

badmintoncryer added 2 commits April 24, 2025 07:30

update readme

b11d702

Merge branch 'main' into s3tables-kms

af8147d

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 23, 2025

Merge branch 'main' into s3tables-kms

7d4da4d

mazyu36 approved these changes Apr 24, 2025

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Apr 24, 2025

badmintoncryer added 4 commits April 24, 2025 11:05

Merge branch 'main' into s3tables-kms

43b65ff

Merge branch 'main' into s3tables-kms

4ee168a

Merge branch 'main' into s3tables-kms

adc3191

Merge branch 'main' into s3tables-kms

3d79d0a

github-actions bot mentioned this pull request May 1, 2025

Monthly PR metrics report #34324

Open

Merge branch 'main' into s3tables-kms

340d275

QuantumNeuralCoder reviewed May 5, 2025

View reviewed changes

shikha372 assigned QuantumNeuralCoder May 5, 2025

Merge branch 'main' into s3tables-kms

46c7e30

QuantumNeuralCoder approved these changes May 9, 2025

View reviewed changes

Merge branch 'main' into s3tables-kms

882f81b

mergify bot merged commit 488f0db into aws:main May 9, 2025
13 of 15 checks passed

github-actions bot locked as resolved and limited conversation to collaborators May 9, 2025

badmintoncryer deleted the s3tables-kms branch May 9, 2025 23:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(s3tables): server-side encryption by customer managed KMS key #34229

feat(s3tables): server-side encryption by customer managed KMS key #34229

badmintoncryer commented Apr 23, 2025

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

badmintoncryer Apr 23, 2025

Uh oh!

QuantumNeuralCoder May 5, 2025 •

edited

Loading

Uh oh!

badmintoncryer May 6, 2025

Uh oh!

QuantumNeuralCoder May 9, 2025

Uh oh!

QuantumNeuralCoder left a comment

Uh oh!

mergify bot commented May 9, 2025

Uh oh!

aws-cdk-automation commented May 9, 2025

Uh oh!

Uh oh!

mergify bot commented May 9, 2025

Uh oh!

github-actions bot commented May 9, 2025

Uh oh!

godwingrs22 commented May 14, 2025

Uh oh!

Uh oh!

feat(s3tables): server-side encryption by customer managed KMS key #34229

feat(s3tables): server-side encryption by customer managed KMS key #34229

Conversation

badmintoncryer commented Apr 23, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 23, 2025

Choose a reason for hiding this comment

Uh oh!

QuantumNeuralCoder May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer May 6, 2025

Choose a reason for hiding this comment

Uh oh!

QuantumNeuralCoder May 9, 2025

Choose a reason for hiding this comment

Uh oh!

QuantumNeuralCoder left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented May 9, 2025

Uh oh!

aws-cdk-automation commented May 9, 2025

AWS CodeBuild CI Report

Uh oh!

Uh oh!

mergify bot commented May 9, 2025

Uh oh!

github-actions bot commented May 9, 2025

Uh oh!

godwingrs22 commented May 14, 2025

Uh oh!

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

QuantumNeuralCoder May 5, 2025 •

edited

Loading