Comments (2)
bundyfx
commented on June 17, 2024
Hi @itsdalmo
When it comes to the S3 Bucket Policy I agree. We don't want any accounts being able to set the Bucket Policy on the Deployment Account. This is fixed now in this PR.
When it comes to the KMS Key, this is essentially the same way as we had it before, however now we are able to scale ADF past the confines of the KMS Key Policy (32kb). Previously, we were appending each new account that was bootstrapped to have access to use the key. It does mean that any role within the organization (that has a policy to allow it) can potentially call kms:decrypt on something within the Pipeline Bucket however this bucket should not contain any private information (only deployment artifacts) . This key should only ever be used for the automation and cross account/region replication aspects that CodePipeline requires. Happy to get your thoughts on this further however.
from aws-deployment-framework.
bundyfx
commented on June 17, 2024
For now i'll close this one off however am happy to open it again and discussion further KMS/S3 related security policies.
from aws-deployment-framework.
Related Issues (20)
- [Bug]: Upgrade to ADF 3.2.0 fails due to non-existing cross-account-role in child OUs HOT 1
- [Bug]: Permission issue when using Github as source
- ADF support for CDK v2 HOT 8
- [Feat]: Update CDK Sample App to modern version HOT 1
- [Feat]: Introduce an ADF pipeline region SSM Parameter store value in raw form
- [Feat]: Do not hardcode DEFAULT_CODEBUILD_IMAGE
- There is already a Construct with name 'iam-target-1-wave-0' in Stack [iam]
- [Feat]: Re-enable cfn-lint HOT 2
- [Feat]: Event based detection method for pipeline with S3 data source
- [Feat]: Support Deployment Maps in Source repositories
- [Bug]: Long and similar pipelines names in same deployment map prevents pipeline from being created
- [Bug]: terraform plan doesn't catch errors
- [Bug]: aws-deployment-framework-base pipeline fails HOT 5
- [Bug]: Description of EventBridge Rules for Completion Triggers shows variables placeholders
- [Bug]: DeleteDefaultVPC fails with OptInRequired HOT 2
- [Feat]: New release HOT 2
- [Bug]: Parameter "deployment_account_id" into deployment account's parameter store HOT 2
- [Feat]: Terraform variables per region
- [Bug]: Account Based Terraform variables do not work
- [Feat]: Improve auto-create-repository behaviour within Deployment Map Definition HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-deployment-framework.