Bootstrapping: Security Hub Findings incorrectly refer to Sid: PipelineCrossAccountArtifactsBucket

[FarrOut]

Describe the issue

Overview

The Concepts > Bootstrapping page of the Dev guide has a section on Security Hub Findings. This sections makes an incorrect reference to a policy statement in the deployment role (cdk-hnb659fds-deploy-role-ACCOUNT-REGION).

Example

Under the paragraph starting with What if I want to fix this finding?

If you are not using AWS CDK Pipelines for cross-account deployments: remove the statement with Sid: PipelineCrossAccountArtifactsBucket from the deploy role; or

If you are using AWS CDK Pipelines for cross-account deployments: after deploying your AWS CDK Pipeline, look up the AWS KMS Key ARN of the Artifact Bucket and replace the Resource: * of the Sid: PipelineCrossAccountArtifactsBucket statement with the actual Key ARN.

Problem

Sid: PipelineCrossAccountArtifactsBucket

Confirmed by inspecting deployment role....generated by CDK version 2.124.0 (build 4b6724c)

        {
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "s3.us-west-1.amazonaws.com"
                }
            },
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "PipelineCrossAccountArtifactsKey"
        },

Proposed Correction

Security Hub Findings should refer to ...Sid: PipelineCrossAccountArtifactsKey

Links

Security Hub Findings

[pahud]

Thanks for report. Let me double check with the team.

[vinayak-kukreja]

Thank you for the report.

I believe if CDK Pipelines are not being used for cross account deployments, then we should delete both PipelineCrossAccountArtifactsKey and PipelineCrossAccountArtifactsBucket from the template.

And, we should also update it to PipelineCrossAccountArtifactsKey instead of PipelineCrossAccountArtifactsBucket in the scenario we are utilizing CDK Pipelines for cross account deployments.

We can update documentation related to this.

[vinayak-kukreja]

Hey thank you for letting us know about this issue.

The documentation has now been updated: https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-securityhub

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.