@aws-cdk/aws-codepipeline: invoking cross-account lambda requires KMS key

[mmendelson222]

Describe the bug

In our use case, a code pipeline deploys CDK based IaC to another account and then invokes a lambda for post-build testing. We are attempting to achieve this through a LambdaInvokeAction.

Older pipelines in our organization generated by CloudFormation achieve this pretty easily.

However, when the action is added to our CDK-generated pipeline, creation of the pipeline fails due to lack of a KMS key on the pipeline's artifact bucket:

The lambda does not require S3 access, so this is an artificial requirement. Lambda invocation in another account should NOT trigger a requirement for a KMS key on the bucket account.

Or is there is a workaround that would not require addition of a KMS key?

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Ability to invoke Lambda in a secondary account without having to add a KMS key to our artifact bucket.

Current Behavior

CDK construct requires our artifact bucket to have a KMS key, despite this being unnecessary. See screen shot in description.

Reproduction Steps

1. Create pipeline with artifact bucket having standard encryption (not KMS)
2. Add a LambdaInvokeAction which invokes an action in another account.
3. Update fails with error "Artifact Bucket must have a KMS Key to add cross-account action..." See screenshot for example.

Possible Solution

A way to "opt out" of cross-account KMS requirement if not needed.
...or...
Simply invoking a lambda in a second account does not trigger isCrossAccount in this location:

aws-cdk/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts

Line 911 in b35adf1

if (action.isCrossAccount) {

Additional Information/Context

No response

CDK CLI Version

2.160.0 (build 7a8ae02)

Framework Version

No response

Node.js Version

v20.8.0

OS

Windows 11

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

@mmendelson222 Good afternoon. Thanks for opening the issue. Per Create a pipeline in CodePipeline that uses resources from another AWS account, you must create an AWS Key Management Service (AWS KMS) key to use, add the key to the pipeline, and set up account policies and roles to enable cross-account access. For an AWS KMS key, you can use the key ID, the key ARN, or the alias ARN.

The above error is thrown by check here, which is in place for over an year. LambdaInvokeActionProps also has optional input artifacts property, which would require KMS key for cross account scenario.

Per exception message, you could set crossAccountKeys: true at Pipeline level which would create encryption key automatically per logic here.

Thanks,
Ashish

[mmendelson222]

@ashishdhingra thanks for your quick response! Yes I see this behavior. What I would like to do here is to invoke the lambda WITHOUT having to create a KMS key on the artifact bucket.

The documentation you referenced above is helpful and does apply IF the cross-account resource we're trying to access is S3. In this case we are not using S3 - we're just executing a Lambda in the second account.

To execute the Lambda all one should need is the proper roles. In our use case those already in place. But this is nothing to do with KMS, so KMS should not be necessary. Thanks.

[ashishdhingra]

@ashishdhingra thanks for your quick response! Yes I see this behavior. What I would like to do here is to invoke the lambda WITHOUT having to create a KMS key on the artifact bucket.

The documentation you referenced above is helpful and does apply IF the cross-account resource we're trying to access is S3. In this case we are not using S3 - we're just executing a Lambda in the second account.

To execute the Lambda all one should need is the proper roles. In our use case those already in place. But this is nothing to do with KMS, so KMS should not be necessary. Thanks.

@mmendelson222 Thanks for your response. As mentioned in my previous comment, LambdaInvokeActionProps also has optional input artifacts property, which would require KMS key for cross account scenario. Your use case might be only invoking Lambda, but if the optional input artifacts are provided, then the scenario would fail due to lack of KMS keys. As of now, there is no way to bypass this validation.

Did you try setting crossAccountKeys as true at Pipeline level which would create encryption key automatically for you if not present?

I have added this issue to CDK team project board for inputs.

Thanks,
Ashish

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.