feat(kms): implement .grant methods for Alias.fromAliasName (under feature flag)

[faridnsh]

This uses the kms:ResourceAliases condition to add statements allowing the methods to the principal of the grant.

Issue

Closes #22697

Reason for this change

When using KMS keys cross stacks, it's sometimes difficult to pass KMS key IDs as they are only generated after deployment, however KMS key aliases could be passed instead and most services accept them. Some constructs that accept a KMS Alias, use .grant methods to add permissions to the role that interacts with the KMS key. Before this PR, the .grant methods of Alias.fromAliasName were not implemented.

Description of changes

This PR implements .grant methods for aliases imported via kms.Alias.fromAliasName so when passed to another a L2 construct that uses .grant methods, the required permissions are added to the role. The added statements will contain a kms:ResourceAliases condition that only allows access to the particular KMS key alias name.

Couple of examples where this is useful:

• Codepipeline construct accepts a S3 bucket for storing artifacts. If this S3 bucket was imported with the KMS key alias being imported as well via kms.Alias.fromAliasName, then this change results in the necessary permission being automatically added to the Codepipeline roles.
• When .grant methods of imported SNS topics or SQS queues with imported KMS key alias for publishers are used, the necessary permission are added to the publisher roles.

Describe any new or updated permissions being added

.grant methods of Alias.fromAliasName now results in new statements with kms:ResourceAliases condition for that alias.

Description of how you validated changes

Added unit tests and integration tests:

• packages/@aws-cdk-testing/framework-integ/test/aws-kms/test/integ.alias-from-alias-name.ts
• packages/aws-cdk-lib/aws-kms/test/alias.test.ts

Deployed my personal project which used Pipelines constructs with imported bucket and kms key from alias and now my pipeline role has correct permissions.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[matboros]

Sorry, im fairly new to the GH review flow, I missed publishing these comments earlier

[faridnsh]

Thanks @matboros, appreciate your review. I added them along with a few more notes about the flag in README and the method docs. I rebased based on latest main branch that broke the build here.

[matboros]

I requested a security review for this pr.

[matboros]

Appsec approved

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

Pull request has been modified.

[matboros]

Thanks for the quick iteration, unfortunately you will have to run the integ tests locally again, and update the generated template to match the new test code :(

[matboros]

lgtm

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

Pull request has been modified.

[aws-cdk-automation]

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: b8790c4
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.