为什么 codepipeline 需要 KMS 密钥？

Question

我制作了 CodePipeline 以通过 cdk

构建从 CodeCommit 到 ECR 的源代码

在部署这个cdk代码的时候，不知何故key是这样命名的

codepipeline-cdkmynavirepomynavipipelinefe7f8d68 制作于 KMS customer managed key

我不知道为什么会这样，我不想用这个。

为什么或在哪里制作此密钥？

const adminPipeline = new codepipeline.Pipeline(this, 'mynaviPipeline', {
  pipelineName: 'cdk-mynavi-pl',
});


const mynavi_cc_repo_name = 'cdk-mynavi-cc'
const mynavi_cc_repo = new codecommit.Repository(this,
  "mynavi-cc-repo",{
    repositoryName: mynavi_cc_repo_name,
    description:"for resizer repo"
})

const adminBuildProject = new codebuild.PipelineProject(this, 'adminBuildproject', {
  environment: {
    buildImage:codebuild.LinuxBuildImage.STANDARD_4_0,
    privileged:true, 
  },
  buildSpec: codebuild.BuildSpec.fromSourceFilename("./buildspec.yml")
});
const adminSourceOutput = new codepipeline.Artifact();
const adminSourceAction = new cdk.aws_codepipeline_actions.CodeCommitSourceAction({
  actionName: 'AdminSource',
  repository: mynavi_cc_repo,
  output: adminSourceOutput,
  trigger:  cdk.aws_codepipeline_actions.CodeCommitTrigger.POLL,
})

const dockerHubSecretArn = 'arn:aws:secretsmanager:ap-northeast-1:678100228231:secret:docker_login-TBFA5B';
const dockerHubSecret = secretsmanager.Secret.fromSecretCompleteArn(this, 'SecretFromCompleteArn', dockerHubSecretArn);

dockerHubSecret.grantRead(adminBuildProject)

cronEcrRepo.grantPullPush(adminBuildProject)
djangoEcrRepo.grantPullPush(adminBuildProject)
nginxEcrRepo.grantPullPush(adminBuildProject)

const adminBuildOutput = new codepipeline.Artifact();
const adminBuildAction = new cdk.aws_codepipeline_actions.CodeBuildAction({
  actionName: 'AdminCodeBuild',
  project: adminBuildProject,
  input: adminSourceOutput,
  outputs: [adminBuildOutput]
});

adminPipeline.addStage({
  stageName: "mynaviSource",
  actions: [adminSourceAction],
});
adminPipeline.addStage({
  stageName : "mynaviBuild",
  actions: [adminBuildAction]
});

Answer 1

它与静态加密有关。

Data in CodePipeline is encrypted at rest using AWS KMS keys. Code artifacts are stored in a customer-owned S3 bucket and encrypted with either the AWS managed key or a customer managed key.

加密 codepipline 工件 默认启用。

If you choose the default option for encrypting code artifacts, CodePipeline uses the AWS managed key. You cannot change or delete this AWS managed key.

您不能禁用加密，但您可以选择加密工件的方式。

好处是，如果您使用默认选项，则不必管理加密密钥。

例如，可以在 CodePipeline 控制台中选择：

更多关于 Data Protection in AWS CodePipeline。