KMS: implement cross-accounts access #8253
Conversation
localstack/services/kms/models.py
Outdated
| if not is_valid_key_arn(self.metadata["KeyId"]): | ||
| self.metadata["KeyId"] = kms_key_arn(self.metadata["KeyId"], account_id, region_name) |
There was a problem hiding this comment.
This is changed to always store the KMS key ARN rather than just the ID.
This is required for cross-account key retiring.
| decoded_token = account_id + ":" + region_name + ":" + long_uid() | ||
| self.token = to_str(base64.b64encode(to_bytes(decoded_token))) |
There was a problem hiding this comment.
Similary, the account ID and region is now encoded in the grant token to help locate the grant when being operated on across-accounts.
| raise InvalidGrantIdException() | ||
| if store.grants[grant_id].metadata["KeyId"] != key_id: | ||
| _, _, grant_key_id = parse_key_arn(grant.metadata.get("KeyId")) | ||
| if key_id != grant_key_id: | ||
| raise ValidationError(f"Invalid KeyId={key_id} specified for grant {grant_id}") | ||
|
|
There was a problem hiding this comment.
This is refactored to simplify the control flow. Only the common logic is retained in this method.
While RevokeGrant and RetireGrant both delete a grant, the parameters they take are different.
| else: | ||
| grant_store = self._get_store(context.account_id, context.region) |
There was a problem hiding this comment.
This condition will never occur; in all the cases where grant_token is None, L458 will throw an exception.
There was a problem hiding this comment.
@sannya-singal: If grant token is not set, but both grant ID and key ID is set, this condition will occur.
Indeed there was no test for this, I've added one.
Summary
This PR adds support for cross-accounts access to following operations in KMS:
In essence, this means that it is possible to use KMS keys belonging to other accounts. This works only when using key ARNs for above operations. Furthermore, this must happen in the same region.
Notes
This PR changes the nature of Grant Tokens. This will therefore break existing pods/persisted states that have grants.