fix(sns): for SSE topics, add KMS permissions in grantPublish

packages/@aws-cdk-testing/framework-integ/test/aws-sns/test/integ.sns.js.snapshot/SNSInteg.template.json

@@ -27,6 +27,17 @@
         }
        },
        "Resource": "*"
+      },
+      {
+       "Action": [
+        "kms:Decrypt",
+        "kms:GenerateDataKey*"
+       ],
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "s3.amazonaws.com"
+       },
+       "Resource": "*"
       }
      ],
      "Version": "2012-10-17"
@@ -132,12 +143,6 @@
    "Type": "AWS::SNS::Topic",
    "Properties": {
     "DisplayName": "fooDisplayName2",
-    "KmsMasterKeyId": {
-     "Fn::GetAtt": [
-      "CustomKey1E6D0D07",
-      "Arn"
-     ]
-    },
     "TopicName": "fooTopic2"
    }
   },
@@ -166,8 +171,26 @@
       {
        "Action": "sns:Publish",
        "Effect": "Allow",
+       "Resource": [
+        {
+         "Ref": "MyTopic288CE2107"
+        },
+        {
+         "Ref": "MyTopic3134CFDFB"
+        }
+       ]
+      },
+      {
+       "Action": [
+        "kms:Decrypt",
+        "kms:GenerateDataKey*"
+       ],
+       "Effect": "Allow",
        "Resource": {
-        "Ref": "MyTopic288CE2107"
+        "Fn::GetAtt": [
+         "CustomKey1E6D0D07",
+         "Arn"
+        ]
        }
       }
      ],
@@ -180,6 +203,19 @@
      }
     ]
    }
+  },
+  "MyTopic3134CFDFB": {
+   "Type": "AWS::SNS::Topic",
+   "Properties": {
+    "DisplayName": "fooDisplayName3",
+    "KmsMasterKeyId": {
+     "Fn::GetAtt": [
+      "CustomKey1E6D0D07",
+      "Arn"
+     ]
+    },
+    "TopicName": "fooTopic3"
+   }
   }
  },
  "Parameters": {

packages/@aws-cdk-testing/framework-integ/test/aws-sns/test/integ.sns.ts

@@ -62,14 +62,32 @@ class SNSInteg extends Stack {
     const topic2 = new Topic(this, 'MyTopic2', {
       topicName: 'fooTopic2',
       displayName: 'fooDisplayName2',
-      masterKey: key,
     });
-    const importedTopic = Topic.fromTopicArn(this, 'ImportedTopic', topic2.topicArn);
+    const importedTopic2 = Topic.fromTopicArn(this, 'ImportedTopic2', topic2.topicArn);
 
     const publishRole = new Role(this, 'PublishRole', {
       assumedBy: new ServicePrincipal('s3.amazonaws.com'),
     });
-    importedTopic.grantPublish(publishRole);
+    importedTopic2.grantPublish(publishRole);
+
+    // Can import encrypted topic by attributes
+    const topic3 = new Topic(this, 'MyTopic3', {
+      topicName: 'fooTopic3',
+      displayName: 'fooDisplayName3',
+      masterKey: key,
+    });
+    const importedTopic3 = Topic.fromTopicAttributes(this, 'ImportedTopic3', {
+      topicArn: topic3.topicArn,
+      keyArn: key.keyArn,
+    });
+    importedTopic3.grantPublish(publishRole);
+
+    // Can reference KMS key after creation
+    topic3.masterKey!.addToResourcePolicy(new PolicyStatement({
+      principals: [new ServicePrincipal('s3.amazonaws.com')],
+      actions: ['kms:GenerateDataKey*', 'kms:Decrypt'],
+      resources: ['*'],
+    }));
   }
 }
 

packages/aws-cdk-lib/aws-sns/lib/topic-base.ts

@@ -5,6 +5,7 @@ import { ITopicSubscription } from './subscriber';
 import { Subscription } from './subscription';
 import * as notifications from '../../aws-codestarnotifications';
 import * as iam from '../../aws-iam';
+import { IKey } from '../../aws-kms';
 import { IResource, Resource, ResourceProps, Token } from '../../core';
 
 /**
@@ -25,6 +26,17 @@ export interface ITopic extends IResource, notifications.INotificationRuleTarget
    */
   readonly topicName: string;
 
+  /**
+   * A KMS Key, either managed by this CDK app, or imported.
+   *
+   * This property applies only to server-side encryption.
+   *
+   * @see https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html
+   *
+   * @default None
+   */
+  readonly masterKey?: IKey;
+
   /**
    * Enables content-based deduplication for FIFO topics.
    *
@@ -72,6 +84,8 @@ export abstract class TopicBase extends Resource implements ITopic {
 
   public abstract readonly topicName: string;
 
+  public abstract readonly masterKey?: IKey;
+
   public abstract readonly fifo: boolean;
 
   public abstract readonly contentBasedDeduplication: boolean;
@@ -173,12 +187,16 @@ export abstract class TopicBase extends Resource implements ITopic {
    * Grant topic publishing permissions to the given identity
    */
   public grantPublish(grantee: iam.IGrantable) {
-    return iam.Grant.addToPrincipalOrResource({
+    const ret = iam.Grant.addToPrincipalOrResource({
       grantee,
       actions: ['sns:Publish'],
       resourceArns: [this.topicArn],
       resource: this,
     });
+    if (this.masterKey) {
+      this.masterKey.grant(grantee, 'kms:Decrypt', 'kms:GenerateDataKey*');
+    }
+    return ret;
   }
 
   /**