KMS keys do not inherit tags from parent stack

[mattchrist]

When creating a KMS key in a stack with tags, the key does not get tagged with the stack's tags.

Reproduction Steps

This stack:

import { App, Stack } from "@aws-cdk/core";
import { Key } from "@aws-cdk/aws-kms";

const app = new App();
const stack = new Stack(app, "keyTagTest", {
  tags: {
    tagName: "tagValue"
  }
});
const key = new Key(stack, "key");

Should create a key with a tag on the kms key, but no tags are present on the kms key.

The created key does not have permissions to kms:TagResource or kms:UntagResource, so tagging is not possible.

Error Log

key (keyFEDD6EC0) Did not have IAM permissions to process tags on AWS::KMS::Key resource.
cdk deploy output:

keyTagTest: deploying...
keyTagTest: creating CloudFormation changeset...
 0/3 | 1:25:30 PM | CREATE_IN_PROGRESS   | AWS::KMS::Key      | key (keyFEDD6EC0) 
 0/3 | 1:25:30 PM | CREATE_IN_PROGRESS   | AWS::CDK::Metadata | CDKMetadata 
 0/3 | 1:25:30 PM | CREATE_IN_PROGRESS   | AWS::KMS::Key      | key (keyFEDD6EC0) Resource creation Initiated
 0/3 | 1:25:32 PM | CREATE_IN_PROGRESS   | AWS::CDK::Metadata | CDKMetadata Resource creation Initiated
 1/3 | 1:25:33 PM | CREATE_COMPLETE      | AWS::CDK::Metadata | CDKMetadata 
1/3 Currently in progress: keyFEDD6EC0
 1/3 | 1:26:31 PM | UPDATE_IN_PROGRESS   | AWS::KMS::Key      | key (keyFEDD6EC0) Did not have IAM permissions to process tags on AWS::KMS::Key resource.
 2/3 | 1:26:31 PM | CREATE_COMPLETE      | AWS::KMS::Key      | key (keyFEDD6EC0) 
 3/3 | 1:26:33 PM | CREATE_COMPLETE      | AWS::CloudFormation::Stack | keyTagTest 
 ✅  keyTagTest

Environment

• CLI Version :1.22.0
• Framework Version:1.22.0
• OS :MacOS 10.14.4
• Language :Typescript

Other

Adding kms:TagResource and kms:UntagResource to default IAM policy for kms keys should resolve this issue. Adding TagResource and UntagResource to when creating the key allow tags to be created on the key.

  const key = new Key(stack, "key", {
    policy: new IAM.PolicyDocument({
      statements: [
        new IAM.PolicyStatement({
          resources: ["*"],
          actions: [
            "kms:Create*",
            "kms:Describe*",
            "kms:Enable*",
            "kms:List*",
            "kms:Put*",
            "kms:Update*",
            "kms:Revoke*",
            "kms:Disable*",
            "kms:Get*",
            "kms:Delete*",
            "kms:ScheduleKeyDeletion",
            "kms:CancelKeyDeletion",
            "kms:GenerateDataKey",
            // default policy does not permit tagging of resources, add additional kms:TagResource action to default policy actions. Fix upstream?
            "kms:TagResource",
            "kms:UntagResource"
          ],
          principals: [new IAM.AccountRootPrincipal()],
          effect: Effect.ALLOW
        })
      ]
    })
  });

---

This is 🐛 Bug Report

[skinny85]

PR: #6125