feat(kms): add sign and verify related grant methods

[clementallen]

Issue

Closes #23185

Reason for this change

Adds grant methods for signing and verifying signatures with KMS

Description of changes

Three new grant methods have been added:

• grantSign(): Adds 'kms:Sign' to the principal
• grantVerify(): Adds 'kms:Verify' to the principal
• grantSignVerify(): Adds ['kms:Sign', 'kms:Verify'] to the principal

Description of how you validated changes

• Added new unit tests to verify the output of the 3 new grant methods
• Added a new integ test for grantSignVerify()

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[codecov]

Codecov Report

Attention: Patch coverage is 11.76471% with 15 lines in your changes missing coverage. Please review.

Project coverage is 66.91%. Comparing base (caf2415) to head (2b4e644).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #32681      +/-   ##
==========================================
- Coverage   66.96%   66.91%   -0.06%     
==========================================
  Files         329      329              
  Lines       18667    18684      +17     
  Branches     3260     3260              
==========================================
+ Hits        12501    12503       +2     
- Misses       5839     5854      +15     
  Partials      327      327              

Flag	Coverage Δ
suite.unit	66.91% <11.76%> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	80.71% <ø> (ø)
packages/aws-cdk-lib/core	82.09% <ø> (ø)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[lpizzinidev]

Looks good to me! Thanks 👍

[samson-keung]

LGTM! Thank you for your contribution.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[clementallen]

LGTM! Thank you for your contribution.

Thank you @samson-keung, there seemed to be some issue rebasing automatically so I've just done it manually

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[samson-keung]

there seemed to be some issue rebasing automatically so I've just done it manually

@clementallen I checked the logs. Looks like the PR had to be rebased again to get the year change in the license files. I have updated the PR branch so it should be good to go. I will check through out the day to make sure this gets merged 👍

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[samson-keung]

Codecov is complaining about missing coverage on the Alias class. Can you add similar unit test you have for the Key class?

Codecov also complains about missing coverage for the KeyBase class which does not make sense to me because you have the unit tests with the Key class already. I will check with the team on this.

[clementallen]

Thanks for checking in on this again @samson-keung, I've added tests for all three methods against the Alias class now as well. Agree it's odd about KeyBase - please let me know if there's anything I can add to help with this!

[clementallen]

@samson-keung I took a further look into the unit test reporting and it still doesn't make sense.

Codecov reports missing lines in the Key class, yet there are unit tests for these lines, and the local Jest coverage report correctly identifies these lines as being tested.

Codecov:

Jest coverage report:

There doesn't see much point adding tests to for the grant methods against Alias.fromAliasName as these are no-ops anyway as grant methods aren't usable against an imported alias just by name.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 2b4e644
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[samson-keung]

@clementallen One of the Codecov jobs were not intended to run in this PR. The configuration has been updated, hence, the PR is now merged. Thanks for waiting while I was resolving the issue.