feat(events): enable customer managed keys to be used with Archive

packages/@aws-cdk-testing/framework-integ/test/aws-events/test/integ.archive-customer-managed-key.ts

@@ -0,0 +1,23 @@
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { App, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import { Archive, EventBus } from 'aws-cdk-lib/aws-events';
+
+const app = new App();
+const stack = new Stack(app, 'archive-customer-managed-key');
+
+const kmsKey = new kms.Key(stack, 'KmsKey', {
+  removalPolicy: RemovalPolicy.DESTROY,
+});
+
+new Archive(stack, 'Archive', {
+  kmsKey: kmsKey,
+  sourceEventBus: EventBus.fromEventBusName(stack, 'DefaultEventBus', 'default'),
+  eventPattern: {
+    source: ['test'],
+  },
+});
+
+new IntegTest(app, 'archive-customer-managed-key-test', {
+  testCases: [stack],
+});

packages/aws-cdk-lib/aws-events/lib/archive.ts

@@ -3,6 +3,7 @@ import { IEventBus } from './event-bus';
 import { EventPattern } from './event-pattern';
 import { CfnArchive } from './events.generated';
 import { renderEventPattern } from './util';
+import * as kms from '../../aws-kms';
 import { Duration, Resource } from '../../core';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
 import { propertyInjectable } from '../../core/lib/prop-injectable';
@@ -32,6 +33,13 @@ export interface BaseArchiveProps {
    * @default - Infinite
    */
   readonly retention?: Duration;
+
+  /**
+   * The customer managed key that encrypts this archive
+   *
+   * @default - Use an AWS managed key
+   */
+  readonly kmsKey?: kms.IKey;
 }
 
 /**
@@ -76,6 +84,7 @@ export class Archive extends Resource {
       eventPattern: renderEventPattern(props.eventPattern),
       retentionDays: props.retention?.toDays({ integral: true }) || 0,
       archiveName: this.physicalName,
+      kmsKeyIdentifier: props?.kmsKey?.keyArn,
     });
 
     this.archiveArn = archive.attrArn;

packages/aws-cdk-lib/aws-events/test/archive.test.ts

@@ -1,4 +1,8 @@
 import { Template } from '../../assertions';
+
+import * as iam from '../../aws-iam';
+import * as kms from '../../aws-kms';
+
 import { Duration, Stack } from '../../core';
 import { EventBus } from '../lib';
 import { Archive } from '../lib/archive';
@@ -93,4 +97,84 @@ describe('archive', () => {
 
     expect(archive.node.defaultChild).toBe(archive.node.findChild('Archive'));
   });
+
+  // Create archive with CMK
+  test('Archive with a customer managed key on an event bus', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    const eventBus = new EventBus(stack, 'Bus');
+    const key = new kms.Key(stack, 'Key');
+
+    // Add the EventBridge in all stages policy statement
+    key.addToResourcePolicy(new iam.PolicyStatement({
+      resources: ['*'],
+      actions: ['kms:Decrypt', 'kms:GenerateDataKey', 'kms:DescribeKey', 'kms:ReEncrypt*'],
+      principals: [
+        new iam.ServicePrincipal('events.amazonaws.com'),
+        new iam.ServicePrincipal('events.aws.internal'),
+      ],
+      sid: 'Allow EventBridge in all stages',
+      effect: iam.Effect.ALLOW,
+    }));
+
+    // WHEN
+    const archive = new Archive(stack, 'Archive', {
+      kmsKey: key,
+      sourceEventBus: eventBus,
+      eventPattern: {
+        source: ['test'],
+      },
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::Events::Archive', {
+      KmsKeyIdentifier: stack.resolve(key.keyArn),
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::KMS::Key', {
+      KeyPolicy: {
+        Statement: [
+          // Match IAM User permissions, should exist by default
+          {
+            Action: 'kms:*',
+            Effect: 'Allow',
+            Principal: {
+              AWS: {
+                'Fn::Join': [
+                  '',
+                  [
+                    'arn:',
+                    {
+                      Ref: 'AWS::Partition',
+                    },
+                    ':iam::',
+                    {
+                      Ref: 'AWS::AccountId',
+                    },
+                    ':root',
+                  ],
+                ],
+              },
+            },
+            Resource: '*',
+          },
+          {
+            Action: [
+              'kms:Decrypt',
+              'kms:GenerateDataKey',
+              'kms:DescribeKey',
+              'kms:ReEncrypt*',
+            ],
+            Effect: 'Allow',
+            Principal: {
+              Service: ['events.amazonaws.com', 'events.aws.internal'],
+            },
+            Resource: '*',
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    });
+  });
 });