KMSKey object cannot add a key policy by calling the addToResourcePolicy function in cdk code?

Question

Hello  ! I'm having trouble setting the KMS Key policy via CDK code, here's how I'm dealing with it so far.

First, I create a KMS Key in a stack and then use the "**new cdk. CfnOutput**" to export the arn of the KMS key.

Then, In another stack use "**cdk. Fn.importValue**" to import the ARN of the KMS Key,  use ”**kms.Key.fromKeyArn**“ to get the KMS Key object.

Finally, I want to add a key policy to a KMS key by calling the "**addToResourcePolicy**" method, but after the deployment is completed, I cannot see the added key policy in the AWS KMS console, but there is no error during the deployment.

The CDK uses the language **typescript**.

The basic invocation process is as follows:
```typescript
// Stask A
demoKMSKey = new kms.Key(this, 'demoKMSKey', {
    alias: `demoKMSKey`,
});

new cdk.CfnOutput(this, 'demoKMSKey-Arn', {
    exportName: 'demoKMSKey-Arn',
    value: demoKMSKey.keyArn,
});

// Stack B
const demoKMSKey = kms.Key.fromKeyArn(
    this,
    'demoKMSKey',
    cdk.Fn.importValue('demoKMSKey-Arn')
);

demoKMSKey.addToResourcePolicy(
    new iam.PolicyStatement({
        sid: `demoKMSKeyPolicy`,
        effect: iam.Effect.ALLOW,
        principals: [new iam.ArnPrincipal(ec2RoleArn)],
        actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:ReEncrypt*', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
        resources: ['*'],
    })
);
```

Current KMS Key Policy is:
```yaml
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678901234:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}
```
Additional Notes:
The user who performs the CDK deployment operation has the` kms:*` permission on any resources.

Accepted Answer

Hello.

If you add a policy to "new kms.Key" as shown below, will it be displayed?  
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_kms.Key.html  
```
demoKMSKey = new kms.Key(this, 'demoKMSKey', {
    alias: `demoKMSKey`,
    policy: ...
});
```

KMSKey object cannot add a key policy by calling the addToResourcePolicy function in cdk code?

相关内容