s3.Bucket.grantDelete on bucket with KMS SSE generates invalid policy

[Roman-L]

Reproduction Steps

This simple stack

Key sseKmsKey = new Key(this, "lapinr-see-kms-key");

BucketProps bucketProperties = BucketProps.builder()
                                          .bucketName("lapinr-test-bucket")
                                          .encryption(BucketEncryption.KMS)
                                          .encryptionKey(sseKmsKey)
                                          .build();
Bucket bucket = new Bucket(this,
                           "LapinrTestBucket",
                           bucketProperties);

RoleProps clientRoleProps = RoleProps.builder()
                                     .roleName("lapinr-access-role")
                                     .assumedBy(new ArnPrincipal("arn:aws:iam::1234567890:role/external-role"))
                                     .build();
Role clientRole = new Role(this,
                           "LapinrAccessRole",
                           clientRoleProps);

bucket.grantDelete(clientRole);

Generates the following policy

"LapinrAccessRoleDefaultPolicy0F01FF42": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:DeleteObject*",
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "LapinrTestBucketDB437746",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            },
            {
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "lapinrseekmskey4CB31ADE",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "LapinrAccessRoleDefaultPolicy0F01FF42",
        "Roles": [
          {
            "Ref": "LapinrAccessRole015FF5A4"
          }
        ]
      }

The problematic part is below, note lack of 'Action' block

{
    "Effect": "Allow",
    "Resource": {
         "Fn::GetAtt": [
            "lapinrseekmskey4CB31ADE",
            "Arn"
         ]
    }
}

Error Log

During CloudFormation stack update, the update fails with a Malformed Policy error due to missing Action block.

Environment

• CLI Version : 1.9.0
• Framework Version: 1.9.0
• OS : Linux
• Language : Java

---

This is 🐛 Bug Report

[Roman-L]

Taking a look at the code

aws-cdk/packages/@aws-cdk/aws-s3/lib/bucket.ts

Lines 451 to 454 in 960d71f

	public grantDelete(identity: iam.IGrantable, objectsKeyPattern: any = '*') {
	return this.grant(identity, perms.BUCKET_DELETE_ACTIONS, [],
	this.arnForObjects(objectsKeyPattern));
	}

Which leads to

aws-cdk/packages/@aws-cdk/aws-s3/lib/bucket.ts

Lines 540 to 542 in 960d71f

	if (this.encryptionKey) {
	this.encryptionKey.grant(grantee, ...keyActions);
	}

Eventually (via aws-kms grant) leads to this, without any checks on actions being empty

aws-cdk/packages/@aws-cdk/aws-iam/lib/grant.ts

Lines 167 to 171 in 69bff3d

	const statement = new PolicyStatement({
	actions: options.actions,
	resources: (options.resourceSelfArns || options.resourceArns),
	principals: [options.resourcePolicyPrincipal || options.grantee!.grantPrincipal]
	});

[NGL321]

Might be related to #4381?
@skinny85

[Roman-L]

At first glance, doesn't seem like it.

Based on the code snippets I provided above, I believe this issue is due to an empty 'actions' parameter that translates to an empty 'Actions' block in the template.
If I'm not mistaken, this makes s3.Bucket.grantDelete un-useable for buckets with SSE KMS.

#4381 has to do with a perceived difference between read/write and encrypt/decrypt. (I don't know enough to tell whether it's actually an issue)

[rix0rrr]

Yep, this should have had an "empty array" check in there.