fix(datazone): correct CloudWatch Logs KMS condition operator and scope#49
Open
marcinc wants to merge 2 commits into
Open
fix(datazone): correct CloudWatch Logs KMS condition operator and scope#49marcinc wants to merge 2 commits into
marcinc wants to merge 2 commits into
Conversation
Two compounding issues caused AmazonBedrockKnowledgeBase environment deployment to fail with "The specified KMS key does not exist or is not allowed to be used": 1. ArnEquals was used instead of ArnLike. ArnEquals treats '*' as a literal character, so the wildcard suffixes in the original two ARN prefixes never matched any real log group ARN. 2. The two hardcoded prefixes (datazone-*, airflow-*) did not cover Bedrock Lambda log groups created by AmazonBedrockKnowledgeBase (/aws/lambda/amazon-bedrock-ide-kbIngestion--* and opensearchIndex--*). Fix: switch to ArnLike and add the Bedrock Lambda log group prefix as a third entry alongside the existing datazone-* and airflow-* prefixes. Also adds kms:DescribeKey, which CloudWatch Logs requires to verify the key before use. Tests: - datazone-l3-construct.test.ts: assert CloudWatchLogsEncryption uses ArnLike with all three expected log group prefixes and kms:DescribeKey - app.test.ts and sm-studio-domain.test.ts: Lambda/Docker mocks to prevent test failures in environments without a Docker daemon
…ion fix Regenerated sagemaker app diff baselines to reflect the updated CloudWatchLogsEncryption statement: ArnEquals replaced with ArnLike, kms:DescribeKey added to allowed actions, and /aws/lambda/amazon-bedrock-ide-* added as a third log group prefix.
marcinc
force-pushed
the
fix/tooling-kms-cloudwatch-logs-condition
branch
from
71d82c6 to
f0e06ca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available: #48
Description of changes:
Two compounding issues caused
AmazonBedrockKnowledgeBaseenvironment deployment in SMUS to fail with "The specified KMS key does not exist or is not allowed to be used":ArnEqualswas used instead ofArnLike.ArnEqualstreats '*' as a literal character, so the wildcard suffixes in the original two ARN prefixes never matched any real log group ARN.The two hardcoded prefixes (
datazone-*,airflow-*) did not cover Bedrock Lambda log groups created byAmazonBedrockKnowledgeBase(/aws/lambda/amazon-bedrock-ide-kbIngestion--*andopensearchIndex--*).Fix: switch to
ArnLikeand add the Bedrock Lambda log group prefix as a third entry alongside the existingdatazone-*andairflow-*prefixes. Also addskms:DescribeKey, which CloudWatch Logs requires to verify the key before use.Tests:
datazone-l3-construct.test.ts: assertCloudWatchLogsEncryptionuses ArnLike with all three expected log group prefixes andkms:DescribeKeyapp.test.tsandsm-studio-domain.test.ts: Lambda/Docker mocks to prevent test failures in environments without a Docker daemonBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.