(aws-cdk): cdk deploy generates IAM roles that don't adhere to Security Hub compliance packs

[meghannoelle]

Describe the bug

I noticed the following security issue via Security Hub for IAM roles created by the cdk deploy process (specifically the roles with Tags of {key: aws-cdk:bootstrap-role, value: deploy}):

• [KMS.2] IAM principals should not have IAM inline policies that allow decryption and re-encryption actions on all KMS keys (https://docs.aws.amazon.com/console/securityhub/KMS.2/remediation)

Expected Behavior

I expected IAM policies generated by cdk deploy to down scope the KMS resource to avoid breaching Security Hub policies.

Current Behavior

The generated AWS CDK bootstrap roles are granted the following policy:
"Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Resource": "*"

Reproduction Steps

• Create a new CDK app via cdk init
• Deploy the following stack:

import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as awsSecurityHub from 'aws-cdk-lib/aws-securityhub';

export class SecurityHubTestStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    new awsSecurityHub.CfnHub(this, 'SecurityHub');
  }
}

• Go to Security Hub in AWS Console and locate the following security breach on cdk IAM roles:
  [KMS.2] IAM principals should not have IAM inline policies that allow decryption and re-encryption actions on all KMS keys

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.35.0 (build 5c23578)

Framework Version

No response

Node.js Version

v14.18.1

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response

[rix0rrr]

Duplicate of #19380

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.