[BUG] PDKPipeline occurs error on latest CDK

[drskur]

Describe the bug

When turn on crossAccountKeys, it occurs following error.

SSE-S3 is the only supported default bucket encryption for Server Access Logging target buckets

Expected Behavior

no error

Current Behavior

occurs error
SSE-S3 is the only supported default bucket encryption for Server Access Logging target buckets

Reproduction Steps

    this.pipeline = new PDKPipeline(this, 'ApplicationPipeline', {
      primarySynthDirectory: 'packages/infra/cdk.out',
      repositoryName: this.node.tryGetContext('repositoryName') || 'monorepo',
      publishAssetsInParallel: false,
      crossAccountKeys: true,
      synth: {},
      sonarCodeScannerConfig: this.node.tryGetContext('sonarqubeScannerConfig'),
    });

Possible Solution

I think it changed the default behavior in the cdk.
So we can create new bucket for server access logging.

Additional Information/Context

"dependencies": {
"aws-cdk-lib": "^2.59.0",
"cdk-nag": "^2.21.51",
"constructs": "^10.1.209"
}

PDK version used

0.12.34

What languages are you seeing this issue on?

Typescript

Environment details (OS name and version, etc.)

Mac OS

[abest0]

@drskur See (aws/aws-cdk#23514). The issue is with the crossAccountKeys: true, prop when PDKPipeline is initialized. This sets up the encryption on the artifacts bucket to use a KMS key.

As a workaround, set crossAccountKeys: false, and the issue will go away.

const artifactBucket = new Bucket(scope, "ArtifactsBucket", {
      enforceSSL: true,
      autoDeleteObjects: true,
      removalPolicy: RemovalPolicy.DESTROY,
      encryption: props.crossAccountKeys
        ? BucketEncryption.KMS    <======== 
        : BucketEncryption.S3_MANAGED,
      encryptionKey: props.crossAccountKeys
        ? new Key(scope, "ArtifactKey", {
            enableKeyRotation: true,
            removalPolicy: RemovalPolicy.DESTROY,
          })
        : undefined,
      publicReadAccess: false,
      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
      serverAccessLogsPrefix: "access-logs",
    });

^(above lines from here)

[drskur]

I checked the code, But I want to deploy it cross account, Pipeline Account to Stage Account. I am not sure it will work or not when I set the crossAccountKeys to false.

[drskur]

It looks to work on 45e9b8b.

[agdimech]

This has been fixed in v 0.12.35