events: events.targets.SqsQueue with Custom KMS key grant too broad permission for a EventBridge rule to publish a message

[argenstijn]

Describe the feature

If you add a SQS Queue as target for a rule it should automatically grant rights for the rule to publish messages to the SQS.
But when the Queue is encrypted with custom KMS key it grant permission for the eventbridge to put events on the queue.
But the permission is totally different compared when you have a queue with managed KMS key or when the queue is not encrypted. Also it's not restrictive enough!. This should be the same!.

See below:

Permission with custom KMS key:

"Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:yyyyyyyy",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "xxxxxxxxxxxxxxxxxxx"
}
}
}

Permission with managed KMS key or not encrypted at all:

"Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:test",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "arn:aws:events:eu-west-1:xxxxxxxxxxxxxxxxxxx:rule/test-bus/test-rule"
}
}

Use Case

You should grant only the target rule permission to publish messages on the queue. No more no less!.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

v2.141.0

Environment details (OS name and version, etc.)

Linux

[pahud]

Thank you for the report. Can you share some minimal code snippets that we can reproduce on our end?

[argenstijn]

This is strange. What i get in my orginal app is the following:

{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": [
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:SendMessage"
],
"Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:yyyyyyyy",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "xxxxxxxxxxxxxxxxxxx"
}
}
}

But in the reproducer it is all oke.

  "Statement": [
{
  "Effect": "Allow",
  "Principal": {
    "Service": "events.amazonaws.com"
  },
  "Action": [
    "sqs:GetQueueAttributes",
    "sqs:GetQueueUrl",
    "sqs:SendMessage"
  ],
  "Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:test",
  "Condition": {
    "ArnEquals": {
      "aws:SourceArn": "arn:aws:events:eu-west-1:xxxxxxxxxxxxxxxxxxx:rule/test-bus/test-rule"
    }
  }
}

So it seems the permission are given. But in my orginal app it uses the SourceAccount instead of the arn of the rule.
Now to figure out why.

[argenstijn]

I notice is that use a custom KMS key it uses "aws:SourceAccount": "xxxxxxxxxxxxxxxxxxx".

The event bridge has permission to use this KMS key. .......

[argenstijn]

Any idea why this? When i use a default SQS key it all works but only when you use a custom KMS with enough permission it uses a SourceAccount in the condition

[argenstijn]

See attachment to reproduce.

reproduce.zip