secretsmanager: Removal Policy set on the secret is not applied to the Resource Policy of the secret

[grbinho]

Describe the bug

If removalPolicy of a secret is set to retain, that is not propagated to ResourcePolicy created/updated for that secret by calling addToResourcePolicy.

Expected Behavior

When removalPolicy is set to RETAIN and secret resource removed from CDK code, I expected that ResourcePolicy of that secret is also retained.

Current Behavior

When removalPolicy is set to RETAIN, and secret resource is removed from CDK code, ResourcePolicy of the secret is deleted.

Reproduction Steps

To replicate this, first create a Secret with a custom resource policy.

  const awsSecret = new Secret(this,'my-secret', {
        secretName: 'my-secret',
        encryptionKey: kmsKey    
        removalPolicy: RemovalPolicy.RETAIN
      })

   awsSecret.addToResourcePolicy(
        new iam.PolicyStatement({
          effect: iam.Effect.ALLOW,
          principals: [myRole],
          actions: ['secretsmanager:DescribeSecret', 'secretsmanager:GetSecretValue'],
          resources: ['*']
        })
      )

Change CDK code and remove the above snipped.
Expectation is that both secret and policy remain in AWS account after deploying.

Possible Solution

removalPolicy is not applied to the ResourcePolicy construct in addToResourcePolicy function.
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L438

applyRemovalPolicy does not consider secrets resource policy
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L655

Additional Information/Context

No response

CDK CLI Version

2.118.0 (build a40f2ec)

Framework Version

No response

Node.js Version

v18.20.2

OS

MacOS Sonoma 14.5 (23F79)

Language

TypeScript

Language Version

5.4.5

Other information

No response

[khushail]

@grbinho , thanks for reaching out.

RemovalPolicy is not set on Resource policy because of the following -

1. Both Secret and SecretResourcePolicy are treated as separate resource as per CDK. It can be verified looking at this cdk diff -

Resources
[+] AWS::KMS::Key KeyTest KeyTestDB4145CA 
[+] AWS::SecretsManager::Secret my-secret-01 mysecret01CE6DE629 
[+] AWS::SecretsManager::ResourcePolicy my-secret-01/Policy mysecret01PolicyB5B07F62 

2. When addToResourcePolicy() is called, it creates a child resource of SecretManager and add the policy statement to the corresponding Secret. See this -

   aws-cdk/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts

   Line 438 in 7cd0f65

   public addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult {

3. when CDK Stack is deleted, the corresponding resources are also deleted which means ResourcePolicy resource (my-secret-01/Policy mysecret01PolicyB5B07F62) is also deleted. but since Secret has retain removalPolicy, it remains existent without CDK Control but the resource policy gets removed from it. Hence there is no resource policy for the secret.

4. If Resource policy is to be maintained at the Secret, one needs to add the RemovalPolicy to the resource policy too and pass it down to L1 resource ,something like this -

   // find the child L2
   const resourcePolicy = awsSecret.node.tryFindChild('Policy') as secrets.ResourcePolicy
   // find the L1
   const cfnResourcePoilcy = resourcePolicy.node.defaultChild as secrets.CfnResourcePolicy
   // now apply the removalPolicy from the L1
   cfnResourcePoilcy.applyRemovalPolicy(RemovalPolicy.RETAIN);

   Hope that helps ! Let me know if there are any questions.

   cc: @pahud (Thanks for guidance here)!

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.