Repository navigation
(bootstrap) FilePublishingRoleDefaultPolicy permission incorrect when FileAssetsBucketKmsKeyId is an ARN value #921
Description
We use a cross-account KMS key to encrypt CDK S3 buckets. When the ARN for this key is provided as the FileAssetsBucketKmsKeyId parameter value, the template generates an invalid policy statement. The parameter description notes that this can be either a KMS key ID or ARN value.
Activity
[-]FilePublishingRoleDefaultPolicy permission incorrect when FileAssetsBucketKmsKeyId is an ARN value[/-][+](bootstrap) FilePublishingRoleDefaultPolicy permission incorrect when FileAssetsBucketKmsKeyId is an ARN value[/+]lemon0333 commentedon Aug 22, 2026
I'd like to take this. Approach: the bootstrap template's
FilePublishingRoleDefaultPolicyalways builds the KMS resource ARN asarn:${Partition}:kms:${Region}:${AccountId}:key/${FileAssetsBucketKmsKeyId}, which breaks whenFileAssetsBucketKmsKeyIdis already a full key ARN (as the parameter description permits) — producing a malformed...:key/arn:aws:kms:.... I'll add a CFN condition that detects when the value already starts witharn:and, in that case, use it directly as the resource; otherwise keep the existing key-id construction. TheAWS_MANAGED_KEY/create-new-key paths are unaffected.