@aws-cdk/aws-sqs - npm Package Compare versions

Comparing version 0.8.1 to 0.8.2

lib/queue-ref.d.ts

@@ -1,2 +0,4 @@
-import { Construct, PolicyStatement, Token } from '@aws-cdk/cdk';
+import kms = require('@aws-cdk/aws-kms');
+import s3n = require('@aws-cdk/aws-s3-notifications');
+import cdk = require('@aws-cdk/cdk');
 import { QueueArn } from './sqs.generated';
@@ -6,7 +8,7 @@ /**
  */
-export declare abstract class QueueRef extends Construct {
+export declare abstract class QueueRef extends cdk.Construct implements s3n.IBucketNotificationDestination {
     /**
      * Import an existing queue
      */
-    static import(parent: Construct, name: string, props: QueueRefProps): void;
+    static import(parent: cdk.Construct, name: string, props: QueueRefProps): void;
     /**
@@ -21,2 +23,6 @@ * The ARN of this queue
     /**
+     * If this queue is server-side encrypted, this is the KMS encryption key.
+     */
+    abstract readonly encryptionMasterKey?: kms.EncryptionKeyRef;
+    /**
      * Controls automatic creation of policy objects.
@@ -29,2 +35,6 @@ *
     /**
+     * The set of S3 bucket IDs that are allowed to send notifications to this queue.
+     */
+    private readonly notifyingBuckets;
+    /**
      * Export a queue
@@ -40,3 +50,10 @@ */
      */
-    addToResourcePolicy(statement: PolicyStatement): void;
+    addToResourcePolicy(statement: cdk.PolicyStatement): void;
+    /**
+     * Allows using SQS queues as destinations for bucket notifications.
+     * Use `bucket.onEvent(event, queue)` to subscribe.
+     * @param bucketArn The ARN of the notifying bucket.
+     * @param bucketId A unique ID for the notifying bucket.
+     */
+    asBucketNotificationDestination(bucketArn: cdk.Arn, bucketId: string): s3n.BucketNotificationDestinationProps;
 }
@@ -47,4 +64,14 @@ /**
 export interface QueueRefProps {
+    /**
+     * The ARN of the queue.
+     */
     queueArn: QueueArn;
+    /**
+     * The URL of the queue.
+     */
     queueUrl: QueueUrl;
+    /**
+     * KMS encryption key, if this queue is server-side encrypted by a KMS key.
+     */
+    keyArn?: kms.KeyArn;
 }
@@ -54,3 +81,3 @@ /**
  */
-export declare class QueueUrl extends Token {
+export declare class QueueUrl extends cdk.Token {
 }

lib/queue-ref.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const cdk_1 = require("@aws-cdk/cdk");
+const kms = require("@aws-cdk/aws-kms");
+const s3n = require("@aws-cdk/aws-s3-notifications");
+const cdk = require("@aws-cdk/cdk");
 const policy_1 = require("./policy");
@@ -8,3 +10,10 @@ /**
  */
-class QueueRef extends cdk_1.Construct {
+class QueueRef extends cdk.Construct {
+    constructor() {
+        super(...arguments);
+        /**
+         * The set of S3 bucket IDs that are allowed to send notifications to this queue.
+         */
+        this.notifyingBuckets = new Set();
+    }
     /**
@@ -21,4 +30,7 @@ * Import an existing queue
         return {
-            queueArn: new cdk_1.Output(this, 'QueueArn', { value: this.queueArn }).makeImportValue(),
-            queueUrl: new cdk_1.Output(this, 'QueueUrl', { value: this.queueUrl }).makeImportValue(),
+            queueArn: new cdk.Output(this, 'QueueArn', { value: this.queueArn }).makeImportValue(),
+            queueUrl: new cdk.Output(this, 'QueueUrl', { value: this.queueUrl }).makeImportValue(),
+            keyArn: this.encryptionMasterKey
+                ? new cdk.Output(this, 'KeyArn', { value: this.encryptionMasterKey.keyArn }).makeImportValue()
+                : undefined
         };
@@ -41,2 +53,34 @@ }
     }
+    /**
+     * Allows using SQS queues as destinations for bucket notifications.
+     * Use `bucket.onEvent(event, queue)` to subscribe.
+     * @param bucketArn The ARN of the notifying bucket.
+     * @param bucketId A unique ID for the notifying bucket.
+     */
+    asBucketNotificationDestination(bucketArn, bucketId) {
+        if (!this.notifyingBuckets.has(bucketId)) {
+            this.addToResourcePolicy(new cdk.PolicyStatement()
+                .addServicePrincipal('s3.amazonaws.com')
+                .addAction('sqs:SendMessage')
+                .addResource(this.queueArn)
+                .addCondition('ArnLike', { 'aws:SourceArn': bucketArn }));
+            // if this queue is encrypted, we need to allow S3 to read messages since that's how
+            // it verifies that the notification destination configuration is valid.
+            // by setting allowNoOp to false, we ensure that only custom keys that we can actually
+            // control access to can be used here as described in:
+            // https://docs.aws.amazon.com/AmazonS3/latest/dev/ways-to-add-notification-config-to-bucket.html
+            if (this.encryptionMasterKey) {
+                this.encryptionMasterKey.addToResourcePolicy(new cdk.PolicyStatement()
+                    .addServicePrincipal('s3.amazonaws.com')
+                    .addAction('kms:GenerateDataKey')
+                    .addAction('kms:Decrypt')
+                    .addResource('*'), /* allowNoOp */ false);
+            }
+            this.notifyingBuckets.add(bucketId);
+        }
+        return {
+            arn: this.queueArn,
+            type: s3n.BucketNotificationDestinationType.Queue
+        };
+    }
 }
@@ -53,2 +97,7 @@ exports.QueueRef = QueueRef;
         this.queueUrl = props.queueUrl;
+        if (props.keyArn) {
+            this.encryptionMasterKey = kms.EncryptionKey.import(this, 'Key', {
+                keyArn: props.keyArn
+            });
+        }
     }
@@ -59,5 +108,5 @@ }
  */
-class QueueUrl extends cdk_1.Token {
+class QueueUrl extends cdk.Token {
 }
 exports.QueueUrl = QueueUrl;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVldWUtcmVmLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicXVldWUtcmVmLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsc0NBQXlFO0FBQ3pFLHFDQUF1QztBQUd2Qzs7R0FFRztBQUNILE1BQXNCLFFBQVMsU0FBUSxlQUFTO0lBQzVDOztPQUVHO0lBQ0ksTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFpQixFQUFFLElBQVksRUFBRSxLQUFvQjtRQUN0RSxJQUFJLGFBQWEsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFxQkQ7O09BRUc7SUFDSSxNQUFNO1FBQ1QsT0FBTztZQUNILFFBQVEsRUFBRSxJQUFJLFlBQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLGVBQWUsRUFBRTtZQUNsRixRQUFRLEVBQUUsSUFBSSxZQUFNLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxlQUFlLEVBQUU7U0FDckYsQ0FBQztJQUNOLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSSxtQkFBbUIsQ0FBQyxTQUEwQjtRQUNqRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUU7WUFDdkMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLG9CQUFXLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFFLElBQUksQ0FBRSxFQUFFLENBQUMsQ0FBQztTQUN2RTtRQUVELElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRTtZQUNiLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztTQUNoRDtJQUNMLENBQUM7Q0FFSjtBQXRERCw0QkFzREM7QUFVRDs7R0FFRztBQUNILE1BQU0sYUFBYyxTQUFRLFFBQVE7SUFNaEMsWUFBWSxNQUFpQixFQUFFLElBQVksRUFBRSxLQUFvQjtRQUM3RCxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBSEwscUJBQWdCLEdBQUcsS0FBSyxDQUFDO1FBSXhDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUMvQixJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUM7SUFDbkMsQ0FBQztDQUNKO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLFFBQVMsU0FBUSxXQUFLO0NBQ2xDO0FBREQsNEJBQ0MifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVldWUtcmVmLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicXVldWUtcmVmLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsd0NBQXlDO0FBQ3pDLHFEQUFzRDtBQUN0RCxvQ0FBcUM7QUFDckMscUNBQXVDO0FBR3ZDOztHQUVHO0FBQ0gsTUFBc0IsUUFBUyxTQUFRLEdBQUcsQ0FBQyxTQUFTO0lBQXBEOztRQWdDSTs7V0FFRztRQUNjLHFCQUFnQixHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFtRTFELENBQUM7SUFyR0c7O09BRUc7SUFDSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQXFCLEVBQUUsSUFBWSxFQUFFLEtBQW9CO1FBQzFFLElBQUksYUFBYSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQStCRDs7T0FFRztJQUNJLE1BQU07UUFDVCxPQUFPO1lBQ0gsUUFBUSxFQUFFLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLGVBQWUsRUFBRTtZQUN0RixRQUFRLEVBQUUsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsZUFBZSxFQUFFO1lBQ3RGLE1BQU0sRUFBRSxJQUFJLENBQUMsbUJBQW1CO2dCQUM1QixDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsZUFBZSxFQUFFO2dCQUM5RixDQUFDLENBQUMsU0FBUztTQUNsQixDQUFDO0lBQ04sQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLG1CQUFtQixDQUFDLFNBQThCO1FBQ3JELElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsRUFBRTtZQUN2QyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksb0JBQVcsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUUsSUFBSSxDQUFFLEVBQUUsQ0FBQyxDQUFDO1NBQ3ZFO1FBRUQsSUFBSSxJQUFJLENBQUMsTUFBTSxFQUFFO1lBQ2IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1NBQ2hEO0lBQ0wsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksK0JBQStCLENBQUMsU0FBa0IsRUFBRSxRQUFnQjtRQUN2RSxJQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUN0QyxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxFQUFFO2lCQUM3QyxtQkFBbUIsQ0FBQyxrQkFBa0IsQ0FBQztpQkFDdkMsU0FBUyxDQUFDLGlCQUFpQixDQUFDO2lCQUM1QixXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztpQkFDMUIsWUFBWSxDQUFDLFNBQVMsRUFBRSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFFOUQsb0ZBQW9GO1lBQ3BGLHdFQUF3RTtZQUN4RSxzRkFBc0Y7WUFDdEYsc0RBQXNEO1lBQ3RELGlHQUFpRztZQUNqRyxJQUFJLElBQUksQ0FBQyxtQkFBbUIsRUFBRTtnQkFDMUIsSUFBSSxDQUFDLG1CQUFtQixDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsRUFBRTtxQkFDakUsbUJBQW1CLENBQUMsa0JBQWtCLENBQUM7cUJBQ3ZDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQztxQkFDaEMsU0FBUyxDQUFDLGFBQWEsQ0FBQztxQkFDeEIsV0FBVyxDQUFDLEdBQUcsQ0FBQyxFQUFFLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQzthQUNqRDtZQUVELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7U0FDdkM7UUFFRCxPQUFPO1lBQ0gsR0FBRyxFQUFFLElBQUksQ0FBQyxRQUFRO1lBQ2xCLElBQUksRUFBRSxHQUFHLENBQUMsaUNBQWlDLENBQUMsS0FBSztTQUNwRCxDQUFDO0lBQ04sQ0FBQztDQUNKO0FBdEdELDRCQXNHQztBQXNCRDs7R0FFRztBQUNILE1BQU0sYUFBYyxTQUFRLFFBQVE7SUFPaEMsWUFBWSxNQUFxQixFQUFFLElBQVksRUFBRSxLQUFvQjtRQUNqRSxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBSEwscUJBQWdCLEdBQUcsS0FBSyxDQUFDO1FBSXhDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUMvQixJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFFL0IsSUFBSSxLQUFLLENBQUMsTUFBTSxFQUFFO1lBQ2QsSUFBSSxDQUFDLG1CQUFtQixHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUU7Z0JBQzdELE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTthQUN2QixDQUFDLENBQUM7U0FDTjtJQUNMLENBQUM7Q0FDSjtBQUVEOztHQUVHO0FBQ0gsTUFBYSxRQUFTLFNBQVEsR0FBRyxDQUFDLEtBQUs7Q0FDdEM7QUFERCw0QkFDQyJ9

lib/queue.d.ts

@@ -176,2 +176,6 @@ import kms = require('@aws-cdk/aws-kms');
     readonly queueUrl: QueueUrl;
+    /**
+     * If this queue is encrypted, this is the KMS key.
+     */
+    encryptionMasterKey?: kms.EncryptionKeyRef;
     protected readonly autoCreatePolicy: boolean;
@@ -178,0 +182,0 @@ constructor(parent: cdk.Construct, name: string, props?: QueueProps);

lib/queue.js

@@ -76,5 +76,5 @@ "use strict";
     determineEncryptionProps(props) {
-        const encryption = props.encryption || QueueEncryption.Unencrypted;
+        let encryption = props.encryption || QueueEncryption.Unencrypted;
         if (encryption !== QueueEncryption.Kms && props.encryptionMasterKey) {
-            throw new Error("Encryption key is specified, so 'encryption' must be set to 'Kms'.");
+            encryption = QueueEncryption.Kms; // KMS is implied by specifying an encryption key
         }
@@ -85,2 +85,5 @@ if (encryption === QueueEncryption.Unencrypted) {
         if (encryption === QueueEncryption.KmsManaged) {
+            this.encryptionMasterKey = kms.EncryptionKey.import(this, 'Key', {
+                keyArn: new kms.KeyArn('alias/aws/sqs')
+            });
             return {
@@ -91,8 +94,8 @@ kmsMasterKeyId: 'alias/aws/sqs',
         }
-        if (props.encryption === QueueEncryption.Kms) {
-            const encryptionKey = props.encryptionMasterKey || new kms.EncryptionKey(this, 'Key', {
+        if (encryption === QueueEncryption.Kms) {
+            this.encryptionMasterKey = props.encryptionMasterKey || new kms.EncryptionKey(this, 'Key', {
                 description: `Created by ${this.path}`
             });
             return {
-                kmsMasterKeyId: encryptionKey.keyArn,
+                kmsMasterKeyId: this.encryptionMasterKey.keyArn,
                 kmsDataKeyReusePeriodSeconds: props.dataKeyReuseSec
@@ -105,2 +108,2 @@ };
 exports.Queue = Queue;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVldWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJxdWV1ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLHdDQUF5QztBQUV6QywyQ0FBaUQ7QUFDakQsbURBQXNFO0FBQ3RFLHFEQUFpRDtBQXdKakQ7O0dBRUc7QUFDSCxJQUFZLGVBaUJYO0FBakJELFdBQVksZUFBZTtJQUN2Qjs7T0FFRztJQUNILHVDQUFvQixDQUFBO0lBRXBCOztPQUVHO0lBQ0gseUNBQXNCLENBQUE7SUFFdEI7Ozs7T0FJRztJQUNILDhCQUFXLENBQUE7QUFDZixDQUFDLEVBakJXLGVBQWUsR0FBZix1QkFBZSxLQUFmLHVCQUFlLFFBaUIxQjtBQUVEOztHQUVHO0FBQ0gsTUFBYSxLQUFNLFNBQVEsb0JBQVE7SUFrQi9CLFlBQVksTUFBcUIsRUFBRSxJQUFZLEVBQUUsUUFBb0IsRUFBRTtRQUNuRSxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBSEwscUJBQWdCLEdBQUcsSUFBSSxDQUFDO1FBS3ZDLDhCQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFckIsTUFBTSxhQUFhLEdBQUcsS0FBSyxDQUFDLGVBQWU7WUFDdkIsQ0FBQyxDQUFDO2dCQUNFLG1CQUFtQixFQUFFLEtBQUssQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLFFBQVE7Z0JBQ3pELGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxDQUFDLGVBQWU7YUFDdkQ7WUFDSCxDQUFDLENBQUMsU0FBUyxDQUFDO1FBRWhDLE1BQU0sS0FBSyxHQUFHLElBQUksOEJBQWMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLFVBQVUsa0JBQzNELFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxJQUN2QixJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLEVBQzlCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsSUFDdkMsYUFBYSxFQUNiLFlBQVksRUFBRSxLQUFLLENBQUMsZ0JBQWdCLEVBQ3BDLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxtQkFBbUIsRUFDN0Msc0JBQXNCLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixFQUNoRCw2QkFBNkIsRUFBRSxLQUFLLENBQUMseUJBQXlCLEVBQzlELGlCQUFpQixFQUFFLEtBQUssQ0FBQyxvQkFBb0IsSUFDL0MsQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUMvQixJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDakMsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDO0lBQzlCLENBQUM7SUFFRDs7T0FFRztJQUNLLGtCQUFrQixDQUFDLEtBQWlCO1FBQ3hDLDBFQUEwRTtRQUMxRSxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDO1FBQzNCLElBQUksT0FBTyxTQUFTLEtBQUssV0FBVyxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFBRSxTQUFTLEdBQUcsSUFBSSxDQUFDO1NBQUU7UUFDdkksSUFBSSxPQUFPLFNBQVMsS0FBSyxXQUFXLElBQUksS0FBSyxDQUFDLHlCQUF5QixFQUFFO1lBQUUsU0FBUyxHQUFHLElBQUksQ0FBQztTQUFFO1FBRTlGLDhEQUE4RDtRQUM5RCxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUU7WUFDckMsSUFBSSxTQUFTLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO2FBQzNEO1lBQ0QsSUFBSSxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO2FBQ2pFO1NBQ0o7UUFFRCxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsSUFBSSxDQUFDLFNBQVMsRUFBRTtZQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7U0FDdEY7UUFFRCxPQUFPO1lBQ0gseUJBQXlCLEVBQUUsS0FBSyxDQUFDLHlCQUF5QjtZQUMxRCxTQUFTO1NBQ1osQ0FBQztJQUNOLENBQUM7SUFFTyx3QkFBd0IsQ0FBQyxLQUFpQjtRQUM5QyxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxJQUFJLGVBQWUsQ0FBQyxXQUFXLENBQUM7UUFFbkUsSUFBSSxVQUFVLEtBQUssZUFBZSxDQUFDLEdBQUcsSUFBSSxLQUFLLENBQUMsbUJBQW1CLEVBQUU7WUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1NBQ3pGO1FBRUQsSUFBSSxVQUFVLEtBQUssZUFBZSxDQUFDLFdBQVcsRUFBRTtZQUM1QyxPQUFPLEVBQUUsQ0FBQztTQUNiO1FBRUQsSUFBSSxVQUFVLEtBQUssZUFBZSxDQUFDLFVBQVUsRUFBRTtZQUMzQyxPQUFPO2dCQUNILGNBQWMsRUFBRSxlQUFlO2dCQUMvQiw0QkFBNEIsRUFBRSxLQUFLLENBQUMsZUFBZTthQUN0RCxDQUFDO1NBQ0w7UUFFRCxJQUFJLEtBQUssQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDLEdBQUcsRUFBRTtZQUMxQyxNQUFNLGFBQWEsR0FBRyxLQUFLLENBQUMsbUJBQW1CLElBQUksSUFBSSxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUU7Z0JBQ2xGLFdBQVcsRUFBRSxjQUFjLElBQUksQ0FBQyxJQUFJLEVBQUU7YUFDekMsQ0FBQyxDQUFDO1lBRUgsT0FBTztnQkFDSCxjQUFjLEVBQUUsYUFBYSxDQUFDLE1BQU07Z0JBQ3BDLDRCQUE0QixFQUFFLEtBQUssQ0FBQyxlQUFlO2FBQ3RELENBQUM7U0FDTDtRQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDbEUsQ0FBQztDQUNKO0FBMUdELHNCQTBHQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVldWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJxdWV1ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLHdDQUF5QztBQUV6QywyQ0FBaUQ7QUFDakQsbURBQXNFO0FBQ3RFLHFEQUFpRDtBQXdKakQ7O0dBRUc7QUFDSCxJQUFZLGVBaUJYO0FBakJELFdBQVksZUFBZTtJQUN2Qjs7T0FFRztJQUNILHVDQUFvQixDQUFBO0lBRXBCOztPQUVHO0lBQ0gseUNBQXNCLENBQUE7SUFFdEI7Ozs7T0FJRztJQUNILDhCQUFXLENBQUE7QUFDZixDQUFDLEVBakJXLGVBQWUsR0FBZix1QkFBZSxLQUFmLHVCQUFlLFFBaUIxQjtBQUVEOztHQUVHO0FBQ0gsTUFBYSxLQUFNLFNBQVEsb0JBQVE7SUF1Qi9CLFlBQVksTUFBcUIsRUFBRSxJQUFZLEVBQUUsUUFBb0IsRUFBRTtRQUNuRSxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBSEwscUJBQWdCLEdBQUcsSUFBSSxDQUFDO1FBS3ZDLDhCQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFckIsTUFBTSxhQUFhLEdBQUcsS0FBSyxDQUFDLGVBQWU7WUFDdkIsQ0FBQyxDQUFDO2dCQUNFLG1CQUFtQixFQUFFLEtBQUssQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLFFBQVE7Z0JBQ3pELGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxDQUFDLGVBQWU7YUFDdkQ7WUFDSCxDQUFDLENBQUMsU0FBUyxDQUFDO1FBRWhDLE1BQU0sS0FBSyxHQUFHLElBQUksOEJBQWMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLFVBQVUsa0JBQzNELFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxJQUN2QixJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLEVBQzlCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsSUFDdkMsYUFBYSxFQUNiLFlBQVksRUFBRSxLQUFLLENBQUMsZ0JBQWdCLEVBQ3BDLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxtQkFBbUIsRUFDN0Msc0JBQXNCLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixFQUNoRCw2QkFBNkIsRUFBRSxLQUFLLENBQUMseUJBQXlCLEVBQzlELGlCQUFpQixFQUFFLEtBQUssQ0FBQyxvQkFBb0IsSUFDL0MsQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUMvQixJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDakMsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDO0lBQzlCLENBQUM7SUFFRDs7T0FFRztJQUNLLGtCQUFrQixDQUFDLEtBQWlCO1FBQ3hDLDBFQUEwRTtRQUMxRSxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDO1FBQzNCLElBQUksT0FBTyxTQUFTLEtBQUssV0FBVyxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFBRSxTQUFTLEdBQUcsSUFBSSxDQUFDO1NBQUU7UUFDdkksSUFBSSxPQUFPLFNBQVMsS0FBSyxXQUFXLElBQUksS0FBSyxDQUFDLHlCQUF5QixFQUFFO1lBQUUsU0FBUyxHQUFHLElBQUksQ0FBQztTQUFFO1FBRTlGLDhEQUE4RDtRQUM5RCxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUU7WUFDckMsSUFBSSxTQUFTLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO2FBQzNEO1lBQ0QsSUFBSSxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO2FBQ2pFO1NBQ0o7UUFFRCxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsSUFBSSxDQUFDLFNBQVMsRUFBRTtZQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7U0FDdEY7UUFFRCxPQUFPO1lBQ0gseUJBQXlCLEVBQUUsS0FBSyxDQUFDLHlCQUF5QjtZQUMxRCxTQUFTO1NBQ1osQ0FBQztJQUNOLENBQUM7SUFFTyx3QkFBd0IsQ0FBQyxLQUFpQjtRQUM5QyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxJQUFJLGVBQWUsQ0FBQyxXQUFXLENBQUM7UUFFakUsSUFBSSxVQUFVLEtBQUssZUFBZSxDQUFDLEdBQUcsSUFBSSxLQUFLLENBQUMsbUJBQW1CLEVBQUU7WUFDakUsVUFBVSxHQUFHLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxpREFBaUQ7U0FDdEY7UUFFRCxJQUFJLFVBQVUsS0FBSyxlQUFlLENBQUMsV0FBVyxFQUFFO1lBQzVDLE9BQU8sRUFBRSxDQUFDO1NBQ2I7UUFFRCxJQUFJLFVBQVUsS0FBSyxlQUFlLENBQUMsVUFBVSxFQUFFO1lBQzNDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxHQUFHLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFO2dCQUM3RCxNQUFNLEVBQUUsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQzthQUMxQyxDQUFDLENBQUM7WUFFSCxPQUFPO2dCQUNILGNBQWMsRUFBRSxlQUFlO2dCQUMvQiw0QkFBNEIsRUFBRSxLQUFLLENBQUMsZUFBZTthQUN0RCxDQUFDO1NBQ0w7UUFFRCxJQUFJLFVBQVUsS0FBSyxlQUFlLENBQUMsR0FBRyxFQUFFO1lBQ3BDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxLQUFLLENBQUMsbUJBQW1CLElBQUksSUFBSSxHQUFHLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUU7Z0JBQ3ZGLFdBQVcsRUFBRSxjQUFjLElBQUksQ0FBQyxJQUFJLEVBQUU7YUFDekMsQ0FBQyxDQUFDO1lBRUgsT0FBTztnQkFDSCxjQUFjLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU07Z0JBQy9DLDRCQUE0QixFQUFFLEtBQUssQ0FBQyxlQUFlO2FBQ3RELENBQUM7U0FDTDtRQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDbEUsQ0FBQztDQUNKO0FBbkhELHNCQW1IQyJ9

lib/sqs.generated.js

@@ -5,3 +5,3 @@ "use strict";
 // See: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html
-// @cfn2ts:meta@ {"generated":"2018-08-09T08:24:49.945Z","fingerprint":"zJQWPDUqmL9+H0d+p9hiSs/R44tbNozlOY5CSe1XCBo="}
+// @cfn2ts:meta@ {"generated":"2018-08-15T13:37:49.560Z","fingerprint":"zJQWPDUqmL9+H0d+p9hiSs/R44tbNozlOY5CSe1XCBo="}
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -8,0 +8,0 @@ // tslint:disable:max-line-length | This is generated code - line lengths are difficult to control

package.json

 {
   "name": "@aws-cdk/aws-sqs",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "CDK Constructs for AWS SQS",
@@ -49,14 +49,16 @@ "main": "lib/index.js",
   "devDependencies": {
-    "@aws-cdk/assert": "^0.8.1",
+    "@aws-cdk/assert": "^0.8.2",
+    "@aws-cdk/aws-s3": "^0.8.2",
     "aws-sdk": "^2.259.1",
-    "cdk-build-tools": "^0.8.1",
-    "cdk-integ-tools": "^0.8.1",
-    "cfn2ts": "^0.8.1",
-    "pkglint": "^0.8.1"
+    "cdk-build-tools": "^0.8.2",
+    "cdk-integ-tools": "^0.8.2",
+    "cfn2ts": "^0.8.2",
+    "pkglint": "^0.8.2"
   },
   "dependencies": {
-    "@aws-cdk/aws-kms": "^0.8.1",
-    "@aws-cdk/cdk": "^0.8.1"
+    "@aws-cdk/aws-kms": "^0.8.2",
+    "@aws-cdk/aws-s3-notifications": "^0.8.2",
+    "@aws-cdk/cdk": "^0.8.2"
   },
   "homepage": "https://github.com/awslabs/aws-cdk"
 }

test/test.sqs.d.ts

@@ -7,3 +7,17 @@ import { Test } from 'nodeunit';
     'exporting and importing works'(test: Test): void;
+    'queue encryption': {
+        'encryptionMasterKey can be set to a custom KMS key'(test: Test): void;
+        'a kms key will be allocated if encryption = kms but a master key is not specified'(test: Test): void;
+        'it is possible to use a managed kms key'(test: Test): void;
+        'export should produce outputs the key arn and return import-values for these outputs': {
+            'with custom key'(test: Test): void;
+            'with managed key'(test: Test): void;
+        };
+    };
+    'bucket notifications': {
+        'queues can be used as destinations'(test: Test): void;
+        'if the queue is encrypted with a custom kms key, the key resource policy is updated to allow s3 to read messages'(test: Test): void;
+        'fails if trying to subscribe to a queue with managed kms encryption'(test: Test): void;
+    };
 };
 export = _default;

test/test.sqs.js

 "use strict";
 const assert_1 = require("@aws-cdk/assert");
+const kms = require("@aws-cdk/aws-kms");
+const s3 = require("@aws-cdk/aws-s3");
 const cdk_1 = require("@aws-cdk/cdk");
-const lib_1 = require("../lib");
+const sqs = require("../lib");
 module.exports = {
     'default properties'(test) {
         const stack = new cdk_1.Stack();
-        new lib_1.Queue(stack, 'Queue');
+        new sqs.Queue(stack, 'Queue');
         assert_1.expect(stack).toMatch({
@@ -20,4 +22,4 @@ "Resources": {
         const stack = new cdk_1.Stack();
-        const dlq = new lib_1.Queue(stack, 'DLQ');
-        new lib_1.Queue(stack, 'Queue', { deadLetterQueue: { queue: dlq, maxReceiveCount: 3 } });
+        const dlq = new sqs.Queue(stack, 'DLQ');
+        new sqs.Queue(stack, 'Queue', { deadLetterQueue: { queue: dlq, maxReceiveCount: 3 } });
         assert_1.expect(stack).toMatch({
@@ -48,3 +50,3 @@ "Resources": {
         const stack = new cdk_1.Stack();
-        const queue = new lib_1.Queue(stack, 'MyQueue');
+        const queue = new sqs.Queue(stack, 'MyQueue');
         queue.addToResourcePolicy(new cdk_1.PolicyStatement().addResource('*').addActions('sqs:*').addPrincipal(new cdk_1.ArnPrincipal('arn')));
@@ -85,8 +87,265 @@ assert_1.expect(stack).toMatch({
         const stack = new cdk_1.Stack();
-        const queue = new lib_1.Queue(stack, 'Queue');
+        const queue = new sqs.Queue(stack, 'Queue');
         const ref = queue.export();
-        lib_1.QueueRef.import(stack, 'Imported', ref);
+        sqs.QueueRef.import(stack, 'Imported', ref);
         test.done();
+    },
+    'queue encryption': {
+        'encryptionMasterKey can be set to a custom KMS key'(test) {
+            const stack = new cdk_1.Stack();
+            const key = new kms.EncryptionKey(stack, 'CustomKey');
+            const queue = new sqs.Queue(stack, 'Queue', { encryptionMasterKey: key });
+            test.same(queue.encryptionMasterKey, key);
+            assert_1.expect(stack).to(assert_1.haveResource('AWS::SQS::Queue', {
+                "KmsMasterKeyId": { "Fn::GetAtt": ["CustomKey1E6D0D07", "Arn"] }
+            }));
+            test.done();
+        },
+        'a kms key will be allocated if encryption = kms but a master key is not specified'(test) {
+            const stack = new cdk_1.Stack();
+            new sqs.Queue(stack, 'Queue', { encryption: sqs.QueueEncryption.Kms });
+            assert_1.expect(stack).to(assert_1.haveResource('AWS::KMS::Key'));
+            assert_1.expect(stack).to(assert_1.haveResource('AWS::SQS::Queue', {
+                "KmsMasterKeyId": {
+                    "Fn::GetAtt": [
+                        "QueueKey39FCBAE6",
+                        "Arn"
+                    ]
+                }
+            }));
+            test.done();
+        },
+        'it is possible to use a managed kms key'(test) {
+            const stack = new cdk_1.Stack();
+            new sqs.Queue(stack, 'Queue', { encryption: sqs.QueueEncryption.KmsManaged });
+            assert_1.expect(stack).toMatch({
+                "Resources": {
+                    "Queue4A7E3555": {
+                        "Type": "AWS::SQS::Queue",
+                        "Properties": {
+                            "KmsMasterKeyId": "alias/aws/sqs"
+                        }
+                    }
+                }
+            });
+            test.done();
+        },
+        'export should produce outputs the key arn and return import-values for these outputs': {
+            'with custom key'(test) {
+                const stack = new cdk_1.Stack();
+                const customKey = new sqs.Queue(stack, 'QueueWithCustomKey', { encryption: sqs.QueueEncryption.Kms });
+                const exportCustom = customKey.export();
+                test.deepEqual(cdk_1.resolve(exportCustom), {
+                    queueArn: { 'Fn::ImportValue': 'QueueWithCustomKeyQueueArnD326BB9B' },
+                    queueUrl: { 'Fn::ImportValue': 'QueueWithCustomKeyQueueUrlF07DDC70' },
+                    keyArn: { 'Fn::ImportValue': 'QueueWithCustomKeyKeyArn537F6E42' }
+                });
+                test.deepEqual(stack.toCloudFormation().Outputs, {
+                    "QueueWithCustomKeyQueueArnD326BB9B": {
+                        "Value": {
+                            "Fn::GetAtt": [
+                                "QueueWithCustomKeyB3E22087",
+                                "Arn"
+                            ]
+                        },
+                        "Export": {
+                            "Name": "QueueWithCustomKeyQueueArnD326BB9B"
+                        }
+                    },
+                    "QueueWithCustomKeyQueueUrlF07DDC70": {
+                        "Value": {
+                            "Ref": "QueueWithCustomKeyB3E22087"
+                        },
+                        "Export": {
+                            "Name": "QueueWithCustomKeyQueueUrlF07DDC70"
+                        }
+                    },
+                    "QueueWithCustomKeyKeyArn537F6E42": {
+                        "Value": {
+                            "Fn::GetAtt": [
+                                "QueueWithCustomKeyD80425F1",
+                                "Arn"
+                            ]
+                        },
+                        "Export": {
+                            "Name": "QueueWithCustomKeyKeyArn537F6E42"
+                        }
+                    }
+                });
+                test.done();
+            },
+            'with managed key'(test) {
+                const stack = new cdk_1.Stack();
+                const managedKey = new sqs.Queue(stack, 'QueueWithManagedKey', { encryption: sqs.QueueEncryption.KmsManaged });
+                const exportManaged = managedKey.export();
+                test.deepEqual(cdk_1.resolve(exportManaged), {
+                    queueArn: { 'Fn::ImportValue': 'QueueWithManagedKeyQueueArn8798A14E' },
+                    queueUrl: { 'Fn::ImportValue': 'QueueWithManagedKeyQueueUrlD735C981' },
+                    keyArn: { 'Fn::ImportValue': 'QueueWithManagedKeyKeyArn9C42A85D' }
+                });
+                test.deepEqual(stack.toCloudFormation().Outputs, {
+                    "QueueWithManagedKeyQueueArn8798A14E": {
+                        "Value": {
+                            "Fn::GetAtt": [
+                                "QueueWithManagedKeyE1B747A1",
+                                "Arn"
+                            ]
+                        },
+                        "Export": {
+                            "Name": "QueueWithManagedKeyQueueArn8798A14E"
+                        }
+                    },
+                    "QueueWithManagedKeyQueueUrlD735C981": {
+                        "Value": {
+                            "Ref": "QueueWithManagedKeyE1B747A1"
+                        },
+                        "Export": {
+                            "Name": "QueueWithManagedKeyQueueUrlD735C981"
+                        }
+                    },
+                    "QueueWithManagedKeyKeyArn9C42A85D": {
+                        "Value": "alias/aws/sqs",
+                        "Export": {
+                            "Name": "QueueWithManagedKeyKeyArn9C42A85D"
+                        }
+                    }
+                });
+                test.done();
+            }
+        }
+    },
+    'bucket notifications': {
+        'queues can be used as destinations'(test) {
+            const stack = new cdk_1.Stack();
+            const queue = new sqs.Queue(stack, 'Queue');
+            const bucket = new s3.Bucket(stack, 'Bucket');
+            bucket.onObjectRemoved(queue);
+            assert_1.expect(stack).to(assert_1.haveResource('AWS::SQS::QueuePolicy', {
+                "PolicyDocument": {
+                    "Statement": [
+                        {
+                            "Action": "sqs:SendMessage",
+                            "Condition": {
+                                "ArnLike": {
+                                    "aws:SourceArn": {
+                                        "Fn::GetAtt": [
+                                            "Bucket83908E77",
+                                            "Arn"
+                                        ]
+                                    }
+                                }
+                            },
+                            "Effect": "Allow",
+                            "Principal": {
+                                "Service": "s3.amazonaws.com"
+                            },
+                            "Resource": {
+                                "Fn::GetAtt": [
+                                    "Queue4A7E3555",
+                                    "Arn"
+                                ]
+                            }
+                        }
+                    ],
+                    "Version": "2012-10-17"
+                },
+                "Queues": [
+                    {
+                        "Ref": "Queue4A7E3555"
+                    }
+                ]
+            }));
+            assert_1.expect(stack).to(assert_1.haveResource('Custom::S3BucketNotifications', {
+                "BucketName": {
+                    "Ref": "Bucket83908E77"
+                },
+                "NotificationConfiguration": {
+                    "QueueConfigurations": [
+                        {
+                            "Events": [
+                                "s3:ObjectRemoved:*"
+                            ],
+                            "QueueArn": {
+                                "Fn::GetAtt": [
+                                    "Queue4A7E3555",
+                                    "Arn"
+                                ]
+                            }
+                        }
+                    ]
+                }
+            }));
+            test.done();
+        },
+        'if the queue is encrypted with a custom kms key, the key resource policy is updated to allow s3 to read messages'(test) {
+            const stack = new cdk_1.Stack();
+            const bucket = new s3.Bucket(stack, 'Bucket');
+            const queue = new sqs.Queue(stack, 'Queue', { encryption: sqs.QueueEncryption.Kms });
+            bucket.onObjectCreated(queue);
+            assert_1.expect(stack).to(assert_1.haveResource('AWS::KMS::Key', {
+                "KeyPolicy": {
+                    "Statement": [
+                        {
+                            "Action": [
+                                "kms:Create*",
+                                "kms:Describe*",
+                                "kms:Enable*",
+                                "kms:List*",
+                                "kms:Put*",
+                                "kms:Update*",
+                                "kms:Revoke*",
+                                "kms:Disable*",
+                                "kms:Get*",
+                                "kms:Delete*",
+                                "kms:ScheduleKeyDeletion",
+                                "kms:CancelKeyDeletion"
+                            ],
+                            "Effect": "Allow",
+                            "Principal": {
+                                "AWS": {
+                                    "Fn::Join": [
+                                        "",
+                                        [
+                                            "arn:",
+                                            {
+                                                "Ref": "AWS::Partition"
+                                            },
+                                            ":iam::",
+                                            {
+                                                "Ref": "AWS::AccountId"
+                                            },
+                                            ":root"
+                                        ]
+                                    ]
+                                }
+                            },
+                            "Resource": "*"
+                        },
+                        {
+                            "Action": [
+                                "kms:GenerateDataKey",
+                                "kms:Decrypt"
+                            ],
+                            "Effect": "Allow",
+                            "Principal": {
+                                "Service": "s3.amazonaws.com"
+                            },
+                            "Resource": "*"
+                        }
+                    ],
+                    "Version": "2012-10-17"
+                },
+                "Description": "Created by Queue"
+            }));
+            test.done();
+        },
+        'fails if trying to subscribe to a queue with managed kms encryption'(test) {
+            const stack = new cdk_1.Stack();
+            const queue = new sqs.Queue(stack, 'Queue', { encryption: sqs.QueueEncryption.KmsManaged });
+            const bucket = new s3.Bucket(stack, 'Bucket');
+            test.throws(() => bucket.onObjectRemoved(queue), 'Unable to add statement to IAM resource policy for KMS key: "alias/aws/sqs"');
+            test.done();
+        }
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdC5zcXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0ZXN0LnNxcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUEsNENBQXlDO0FBQ3pDLHNDQUFvRTtBQUVwRSxnQ0FBeUM7QUFJekMsaUJBQVM7SUFDTCxvQkFBb0IsQ0FBQyxJQUFVO1FBQzNCLE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7UUFDMUIsSUFBSSxXQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRTFCLGVBQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7WUFDbEIsV0FBVyxFQUFFO2dCQUNYLGVBQWUsRUFBRTtvQkFDZixNQUFNLEVBQUUsaUJBQWlCO2lCQUMxQjthQUNGO1NBQ0osQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFDRCwwQkFBMEIsQ0FBQyxJQUFVO1FBQ2pDLE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7UUFDMUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxXQUFLLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3BDLElBQUksV0FBSyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxlQUFlLEVBQUUsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLGVBQWUsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFbkYsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQztZQUNsQixXQUFXLEVBQUU7Z0JBQ1gsYUFBYSxFQUFFO29CQUNiLE1BQU0sRUFBRSxpQkFBaUI7aUJBQzFCO2dCQUNELGVBQWUsRUFBRTtvQkFDZixNQUFNLEVBQUUsaUJBQWlCO29CQUN6QixZQUFZLEVBQUU7d0JBQ1osZUFBZSxFQUFFOzRCQUNmLHFCQUFxQixFQUFFO2dDQUNyQixZQUFZLEVBQUU7b0NBQ1osYUFBYTtvQ0FDYixLQUFLO2lDQUNOOzZCQUNGOzRCQUNELGlCQUFpQixFQUFFLENBQUM7eUJBQ3JCO3FCQUNGO2lCQUNGO2FBQ0Y7U0FDSixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztJQUVELCtEQUErRCxDQUFDLElBQVU7UUFDdEUsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztRQUMxQixNQUFNLEtBQUssR0FBRyxJQUFJLFdBQUssQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDMUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDLElBQUkscUJBQWUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsWUFBWSxDQUFDLElBQUksa0JBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDNUgsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQztZQUNsQixXQUFXLEVBQUU7Z0JBQ1gsaUJBQWlCLEVBQUU7b0JBQ2pCLE1BQU0sRUFBRSxpQkFBaUI7aUJBQzFCO2dCQUNELHVCQUF1QixFQUFFO29CQUN2QixNQUFNLEVBQUUsdUJBQXVCO29CQUMvQixZQUFZLEVBQUU7d0JBQ1osZ0JBQWdCLEVBQUU7NEJBQ2hCLFdBQVcsRUFBRTtnQ0FDWDtvQ0FDRSxRQUFRLEVBQUUsT0FBTztvQ0FDakIsUUFBUSxFQUFFLE9BQU87b0NBQ2pCLFdBQVcsRUFBRTt3Q0FDWCxLQUFLLEVBQUUsS0FBSztxQ0FDYjtvQ0FDRCxVQUFVLEVBQUUsR0FBRztpQ0FDaEI7NkJBQ0Y7NEJBQ0QsU0FBUyxFQUFFLFlBQVk7eUJBQ3hCO3dCQUNELFFBQVEsRUFBRTs0QkFDUjtnQ0FDRSxLQUFLLEVBQUUsaUJBQWlCOzZCQUN6Qjt5QkFDRjtxQkFDRjtpQkFDRjthQUNGO1NBQ0osQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFFRCwrQkFBK0IsQ0FBQyxJQUFVO1FBQ3hDLE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7UUFDMUIsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRXhDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUUzQixjQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFFeEMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2QsQ0FBQztDQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdC5zcXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0ZXN0LnNxcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUEsNENBQXVEO0FBQ3ZELHdDQUF5QztBQUN6QyxzQ0FBdUM7QUFDdkMsc0NBQTZFO0FBRTdFLDhCQUErQjtBQUkvQixpQkFBUztJQUNMLG9CQUFvQixDQUFDLElBQVU7UUFDM0IsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztRQUMxQixJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRTlCLGVBQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7WUFDbEIsV0FBVyxFQUFFO2dCQUNYLGVBQWUsRUFBRTtvQkFDZixNQUFNLEVBQUUsaUJBQWlCO2lCQUMxQjthQUNGO1NBQ0osQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFDRCwwQkFBMEIsQ0FBQyxJQUFVO1FBQ2pDLE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7UUFDMUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN4QyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLGVBQWUsRUFBRSxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsZUFBZSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUV2RixlQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1lBQ2xCLFdBQVcsRUFBRTtnQkFDWCxhQUFhLEVBQUU7b0JBQ2IsTUFBTSxFQUFFLGlCQUFpQjtpQkFDMUI7Z0JBQ0QsZUFBZSxFQUFFO29CQUNmLE1BQU0sRUFBRSxpQkFBaUI7b0JBQ3pCLFlBQVksRUFBRTt3QkFDWixlQUFlLEVBQUU7NEJBQ2YscUJBQXFCLEVBQUU7Z0NBQ3JCLFlBQVksRUFBRTtvQ0FDWixhQUFhO29DQUNiLEtBQUs7aUNBQ047NkJBQ0Y7NEJBQ0QsaUJBQWlCLEVBQUUsQ0FBQzt5QkFDckI7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNKLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNoQixDQUFDO0lBRUQsK0RBQStELENBQUMsSUFBVTtRQUN0RSxNQUFNLEtBQUssR0FBRyxJQUFJLFdBQUssRUFBRSxDQUFDO1FBQzFCLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDOUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDLElBQUkscUJBQWUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsWUFBWSxDQUFDLElBQUksa0JBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDNUgsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sQ0FBQztZQUNsQixXQUFXLEVBQUU7Z0JBQ1gsaUJBQWlCLEVBQUU7b0JBQ2pCLE1BQU0sRUFBRSxpQkFBaUI7aUJBQzFCO2dCQUNELHVCQUF1QixFQUFFO29CQUN2QixNQUFNLEVBQUUsdUJBQXVCO29CQUMvQixZQUFZLEVBQUU7d0JBQ1osZ0JBQWdCLEVBQUU7NEJBQ2hCLFdBQVcsRUFBRTtnQ0FDWDtvQ0FDRSxRQUFRLEVBQUUsT0FBTztvQ0FDakIsUUFBUSxFQUFFLE9BQU87b0NBQ2pCLFdBQVcsRUFBRTt3Q0FDWCxLQUFLLEVBQUUsS0FBSztxQ0FDYjtvQ0FDRCxVQUFVLEVBQUUsR0FBRztpQ0FDaEI7NkJBQ0Y7NEJBQ0QsU0FBUyxFQUFFLFlBQVk7eUJBQ3hCO3dCQUNELFFBQVEsRUFBRTs0QkFDUjtnQ0FDRSxLQUFLLEVBQUUsaUJBQWlCOzZCQUN6Qjt5QkFDRjtxQkFDRjtpQkFDRjthQUNGO1NBQ0osQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFFRCwrQkFBK0IsQ0FBQyxJQUFVO1FBQ3RDLE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7UUFDMUIsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUU1QyxNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFFM0IsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUU1QyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztJQUVELGtCQUFrQixFQUFFO1FBQ2hCLG9EQUFvRCxDQUFDLElBQVU7WUFDM0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztZQUUxQixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBQ3RELE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUUsbUJBQW1CLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUUxRSxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLENBQUMsQ0FBQztZQUMxQyxlQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLHFCQUFZLENBQUMsaUJBQWlCLEVBQUU7Z0JBQzdDLGdCQUFnQixFQUFFLEVBQUUsWUFBWSxFQUFFLENBQUUsbUJBQW1CLEVBQUUsS0FBSyxDQUFFLEVBQUU7YUFDckUsQ0FBQyxDQUFDLENBQUM7WUFFSixJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsQ0FBQztRQUVELG1GQUFtRixDQUFDLElBQVU7WUFDMUYsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztZQUUxQixJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLFVBQVUsRUFBRSxHQUFHLENBQUMsZUFBZSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFFdkUsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxxQkFBWSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7WUFDaEQsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxxQkFBWSxDQUFDLGlCQUFpQixFQUFFO2dCQUMvQyxnQkFBZ0IsRUFBRTtvQkFDaEIsWUFBWSxFQUFFO3dCQUNaLGtCQUFrQjt3QkFDbEIsS0FBSztxQkFDTjtpQkFDRjthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hCLENBQUM7UUFFRCx5Q0FBeUMsQ0FBQyxJQUFVO1lBQ2hELE1BQU0sS0FBSyxHQUFHLElBQUksV0FBSyxFQUFFLENBQUM7WUFFMUIsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxVQUFVLEVBQUUsR0FBRyxDQUFDLGVBQWUsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQzlFLGVBQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7Z0JBQ3BCLFdBQVcsRUFBRTtvQkFDWCxlQUFlLEVBQUU7d0JBQ2YsTUFBTSxFQUFFLGlCQUFpQjt3QkFDekIsWUFBWSxFQUFFOzRCQUNaLGdCQUFnQixFQUFFLGVBQWU7eUJBQ2xDO3FCQUNGO2lCQUNGO2FBQ0YsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hCLENBQUM7UUFFRCxzRkFBc0YsRUFBRTtZQUVwRixpQkFBaUIsQ0FBQyxJQUFVO2dCQUN4QixNQUFNLEtBQUssR0FBRyxJQUFJLFdBQUssRUFBRSxDQUFDO2dCQUUxQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLG9CQUFvQixFQUFFLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxlQUFlLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFFdEcsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUV4QyxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQU8sQ0FBQyxZQUFZLENBQUMsRUFBRTtvQkFDbEMsUUFBUSxFQUFFLEVBQUUsaUJBQWlCLEVBQUUsb0NBQW9DLEVBQUU7b0JBQ3JFLFFBQVEsRUFBRSxFQUFFLGlCQUFpQixFQUFFLG9DQUFvQyxFQUFFO29CQUNyRSxNQUFNLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxrQ0FBa0MsRUFBRTtpQkFDcEUsQ0FBQyxDQUFDO2dCQUVILElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLGdCQUFnQixFQUFFLENBQUMsT0FBTyxFQUFFO29CQUMvQyxvQ0FBb0MsRUFBRTt3QkFDcEMsT0FBTyxFQUFFOzRCQUNQLFlBQVksRUFBRTtnQ0FDWiw0QkFBNEI7Z0NBQzVCLEtBQUs7NkJBQ047eUJBQ0Y7d0JBQ0QsUUFBUSxFQUFFOzRCQUNSLE1BQU0sRUFBRSxvQ0FBb0M7eUJBQzdDO3FCQUNGO29CQUNELG9DQUFvQyxFQUFFO3dCQUNwQyxPQUFPLEVBQUU7NEJBQ1AsS0FBSyxFQUFFLDRCQUE0Qjt5QkFDcEM7d0JBQ0QsUUFBUSxFQUFFOzRCQUNSLE1BQU0sRUFBRSxvQ0FBb0M7eUJBQzdDO3FCQUNGO29CQUNELGtDQUFrQyxFQUFFO3dCQUNsQyxPQUFPLEVBQUU7NEJBQ1AsWUFBWSxFQUFFO2dDQUNaLDRCQUE0QjtnQ0FDNUIsS0FBSzs2QkFDTjt5QkFDRjt3QkFDRCxRQUFRLEVBQUU7NEJBQ1IsTUFBTSxFQUFFLGtDQUFrQzt5QkFDM0M7cUJBQ0Y7aUJBQ0YsQ0FBQyxDQUFDO2dCQUNILElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNoQixDQUFDO1lBRUQsa0JBQWtCLENBQUMsSUFBVTtnQkFDekIsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztnQkFFMUIsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxFQUFFLFVBQVUsRUFBRSxHQUFHLENBQUMsZUFBZSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7Z0JBRS9HLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFFMUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFPLENBQUMsYUFBYSxDQUFDLEVBQUU7b0JBQ25DLFFBQVEsRUFBRSxFQUFFLGlCQUFpQixFQUFFLHFDQUFxQyxFQUFFO29CQUN0RSxRQUFRLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxxQ0FBcUMsRUFBRTtvQkFDdEUsTUFBTSxFQUFFLEVBQUUsaUJBQWlCLEVBQUUsbUNBQW1DLEVBQUU7aUJBQ3JFLENBQUMsQ0FBQztnQkFFSCxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLE9BQU8sRUFBRTtvQkFDL0MscUNBQXFDLEVBQUU7d0JBQ3JDLE9BQU8sRUFBRTs0QkFDUCxZQUFZLEVBQUU7Z0NBQ1osNkJBQTZCO2dDQUM3QixLQUFLOzZCQUNOO3lCQUNGO3dCQUNELFFBQVEsRUFBRTs0QkFDUixNQUFNLEVBQUUscUNBQXFDO3lCQUM5QztxQkFDRjtvQkFDRCxxQ0FBcUMsRUFBRTt3QkFDckMsT0FBTyxFQUFFOzRCQUNQLEtBQUssRUFBRSw2QkFBNkI7eUJBQ3JDO3dCQUNELFFBQVEsRUFBRTs0QkFDUixNQUFNLEVBQUUscUNBQXFDO3lCQUM5QztxQkFDRjtvQkFDRCxtQ0FBbUMsRUFBRTt3QkFDbkMsT0FBTyxFQUFFLGVBQWU7d0JBQ3hCLFFBQVEsRUFBRTs0QkFDUixNQUFNLEVBQUUsbUNBQW1DO3lCQUM1QztxQkFDRjtpQkFDRixDQUFDLENBQUM7Z0JBRUgsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2hCLENBQUM7U0FFSjtLQUVKO0lBRUQsc0JBQXNCLEVBQUU7UUFFcEIsb0NBQW9DLENBQUMsSUFBVTtZQUMzQyxNQUFNLEtBQUssR0FBRyxJQUFJLFdBQUssRUFBRSxDQUFDO1lBRTFCLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDNUMsTUFBTSxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztZQUU5QyxNQUFNLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBRTlCLGVBQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMscUJBQVksQ0FBQyx1QkFBdUIsRUFBRTtnQkFDckQsZ0JBQWdCLEVBQUU7b0JBQ2hCLFdBQVcsRUFBRTt3QkFDWDs0QkFDRSxRQUFRLEVBQUUsaUJBQWlCOzRCQUMzQixXQUFXLEVBQUU7Z0NBQ1gsU0FBUyxFQUFFO29DQUNULGVBQWUsRUFBRTt3Q0FDZixZQUFZLEVBQUU7NENBQ1osZ0JBQWdCOzRDQUNoQixLQUFLO3lDQUNOO3FDQUNGO2lDQUNGOzZCQUNGOzRCQUNELFFBQVEsRUFBRSxPQUFPOzRCQUNqQixXQUFXLEVBQUU7Z0NBQ1gsU0FBUyxFQUFFLGtCQUFrQjs2QkFDOUI7NEJBQ0QsVUFBVSxFQUFFO2dDQUNWLFlBQVksRUFBRTtvQ0FDWixlQUFlO29DQUNmLEtBQUs7aUNBQ047NkJBQ0Y7eUJBQ0Y7cUJBQ0Y7b0JBQ0QsU0FBUyxFQUFFLFlBQVk7aUJBQ3hCO2dCQUNELFFBQVEsRUFBRTtvQkFDUjt3QkFDRSxLQUFLLEVBQUUsZUFBZTtxQkFDdkI7aUJBQ0Y7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLGVBQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMscUJBQVksQ0FBQywrQkFBK0IsRUFBRTtnQkFDN0QsWUFBWSxFQUFFO29CQUNaLEtBQUssRUFBRSxnQkFBZ0I7aUJBQ3hCO2dCQUNELDJCQUEyQixFQUFFO29CQUMzQixxQkFBcUIsRUFBRTt3QkFDckI7NEJBQ0UsUUFBUSxFQUFFO2dDQUNSLG9CQUFvQjs2QkFDckI7NEJBQ0QsVUFBVSxFQUFFO2dDQUNWLFlBQVksRUFBRTtvQ0FDWixlQUFlO29DQUNmLEtBQUs7aUNBQ047NkJBQ0Y7eUJBQ0Y7cUJBQ0Y7aUJBQ0Y7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNoQixDQUFDO1FBRUQsa0hBQWtILENBQUMsSUFBVTtZQUV6SCxNQUFNLEtBQUssR0FBRyxJQUFJLFdBQUssRUFBRSxDQUFDO1lBQzFCLE1BQU0sTUFBTSxHQUFHLElBQUksRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDOUMsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxVQUFVLEVBQUUsR0FBRyxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBRXJGLE1BQU0sQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7WUFFOUIsZUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxxQkFBWSxDQUFDLGVBQWUsRUFBRTtnQkFDN0MsV0FBVyxFQUFFO29CQUNYLFdBQVcsRUFBRTt3QkFDWDs0QkFDRSxRQUFRLEVBQUU7Z0NBQ1IsYUFBYTtnQ0FDYixlQUFlO2dDQUNmLGFBQWE7Z0NBQ2IsV0FBVztnQ0FDWCxVQUFVO2dDQUNWLGFBQWE7Z0NBQ2IsYUFBYTtnQ0FDYixjQUFjO2dDQUNkLFVBQVU7Z0NBQ1YsYUFBYTtnQ0FDYix5QkFBeUI7Z0NBQ3pCLHVCQUF1Qjs2QkFDeEI7NEJBQ0QsUUFBUSxFQUFFLE9BQU87NEJBQ2pCLFdBQVcsRUFBRTtnQ0FDWCxLQUFLLEVBQUU7b0NBQ0wsVUFBVSxFQUFFO3dDQUNWLEVBQUU7d0NBQ0Y7NENBQ0UsTUFBTTs0Q0FDTjtnREFDRSxLQUFLLEVBQUUsZ0JBQWdCOzZDQUN4Qjs0Q0FDRCxRQUFROzRDQUNSO2dEQUNFLEtBQUssRUFBRSxnQkFBZ0I7NkNBQ3hCOzRDQUNELE9BQU87eUNBQ1I7cUNBQ0Y7aUNBQ0Y7NkJBQ0Y7NEJBQ0QsVUFBVSxFQUFFLEdBQUc7eUJBQ2hCO3dCQUNEOzRCQUNFLFFBQVEsRUFBRTtnQ0FDUixxQkFBcUI7Z0NBQ3JCLGFBQWE7NkJBQ2Q7NEJBQ0QsUUFBUSxFQUFFLE9BQU87NEJBQ2pCLFdBQVcsRUFBRTtnQ0FDWCxTQUFTLEVBQUUsa0JBQWtCOzZCQUM5Qjs0QkFDRCxVQUFVLEVBQUUsR0FBRzt5QkFDaEI7cUJBQ0Y7b0JBQ0QsU0FBUyxFQUFFLFlBQVk7aUJBQ3hCO2dCQUNELGFBQWEsRUFBRSxrQkFBa0I7YUFDbEMsQ0FBQyxDQUFDLENBQUM7WUFFSixJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsQ0FBQztRQUVELHFFQUFxRSxDQUFDLElBQVU7WUFDNUUsTUFBTSxLQUFLLEdBQUcsSUFBSSxXQUFLLEVBQUUsQ0FBQztZQUMxQixNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLFVBQVUsRUFBRSxHQUFHLENBQUMsZUFBZSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7WUFDNUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztZQUM5QyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLEVBQUUsNkVBQTZFLENBQUMsQ0FBQztZQUNoSSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsQ0FBQztLQUVKO0NBQ0osQ0FBQyJ9

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

150589

increased by42.52%

Number of package files

27

increased by12.5%

Lines of code

1689

increased by74.12%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dependency count

3

increased by50%

Dev dependency count

7

increased by16.67%

Dependency changes

• + Added@aws-cdk/aws-s3-notifications@^0.8.2

• + Added@aws-cdk/aws-s3-notifications@0.8.2(transitive)

• Updated@aws-cdk/aws-kms@^0.8.2

• Updated@aws-cdk/cdk@^0.8.2