aws-delivlib 13.6.2 → 13.7.0

package/cdk.out/delivlib-test.template.json

@@ -6857,7 +6857,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": "cdk-hnb659fds-assets-712950704752-us-east-1",
-          "S3Key": "98dba9b3d79739d40a37e0621754556a791eef3b1c96e913c6e8d5df3a379bd4.zip"
+          "S3Key": "0ff875115bf3a3ba9f32946b1f2b9b153553ecba0e511c42ac11bef064968c40.zip"
         },
         "Role": {
           "Fn::GetAtt": [
@@ -7054,6 +7054,141 @@
         "aws:cdk:path": "delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/OpenSslCliLayer/Resource"
       }
     },
+    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261": {
+      "Type": "AWS::S3::Bucket",
+      "Properties": {
+        "BucketEncryption": {
+          "ServerSideEncryptionConfiguration": [
+            {
+              "ServerSideEncryptionByDefault": {
+                "SSEAlgorithm": "AES256"
+              }
+            }
+          ]
+        },
+        "Tags": [
+          {
+            "Key": "aws-cdk:auto-delete-objects",
+            "Value": "true"
+          }
+        ]
+      },
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete",
+      "Metadata": {
+        "aws:cdk:path": "delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/Resource"
+      }
+    },
+    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketPolicy8E2DB075": {
+      "Type": "AWS::S3::BucketPolicy",
+      "Properties": {
+        "Bucket": {
+          "Ref": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261"
+        },
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": "s3:*",
+              "Condition": {
+                "Bool": {
+                  "aws:SecureTransport": "false"
+                }
+              },
+              "Effect": "Deny",
+              "Principal": {
+                "AWS": "*"
+              },
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            },
+            {
+              "Action": [
+                "s3:GetBucket*",
+                "s3:List*",
+                "s3:DeleteObject*"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": {
+                  "Fn::GetAtt": [
+                    "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
+                    "Arn"
+                  ]
+                }
+              },
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      },
+      "Metadata": {
+        "aws:cdk:path": "delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/Policy/Resource"
+      }
+    },
+    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketAutoDeleteObjectsCustomResource8471F189": {
+      "Type": "Custom::S3AutoDeleteObjects",
+      "Properties": {
+        "ServiceToken": {
+          "Fn::GetAtt": [
+            "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
+            "Arn"
+          ]
+        },
+        "BucketName": {
+          "Ref": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261"
+        }
+      },
+      "DependsOn": [
+        "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketPolicy8E2DB075"
+      ],
+      "UpdateReplacePolicy": "Delete",
+      "DeletionPolicy": "Delete",
+      "Metadata": {
+        "aws:cdk:path": "delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/AutoDeleteObjectsCustomResource/Default"
+      }
+    },
     "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequest7F706C9D": {
       "Type": "Custom::CertificateSigningRequest",
       "Properties": {
@@ -7063,7 +7198,7 @@
             "Arn"
           ]
         },
-        "ResourceVersion": "0iNb/IhC8/vyyIyiktjSz6maP//45F9xl6pxQRtkscE=",
+        "ResourceVersion": "iya3EURiIdG1hRWpTxUXI9stXq1asjZOpJDjraiV9dM=",
         "PrivateKeySecretId": {
           "Fn::GetAtt": [
             "X509CodeSigningKeyRSAPrivateKeyE5980A70",
@@ -7078,7 +7213,10 @@
         "DnOrganizationalUnitName": "AWS",
         "DnEmailAddress": "aws-cdk-dev+delivlib-test@amazon.com",
         "ExtendedKeyUsage": "critical,codeSigning",
-        "KeyUsage": "critical,digitalSignature"
+        "KeyUsage": "critical,digitalSignature",
+        "OutputBucket": {
+          "Ref": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261"
+        }
       },
       "DependsOn": [
         "CreateCSR541F67826DCF49A78C5A67715ADD9E4CServiceRoleDefaultPolicyC0800208",
@@ -7264,6 +7402,39 @@
       "Properties": {
         "PolicyDocument": {
           "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*",
+                "s3:DeleteObject*",
+                "s3:PutObject*",
+                "s3:Abort*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            },
             {
               "Action": "secretsmanager:GetSecretValue",
               "Effect": "Allow",
@@ -7293,7 +7464,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": "cdk-hnb659fds-assets-712950704752-us-east-1",
-          "S3Key": "70d613312145b8280d33a47035cc5be2a9bd0e5069705e39f83b14cd1f720e99.zip"
+          "S3Key": "9012a4bd6eb36f7ec4fec65ce817435d9b8dda297c62e87163a773c7d25c60a9.zip"
         },
         "Role": {
           "Fn::GetAtt": [
@@ -7319,6 +7490,68 @@
         "aws:cdk:path": "delivlib-test/CreateCSR541F67826DCF49A78C5A67715ADD9E4C/Resource"
       }
     },
+    "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ]
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          }
+        ]
+      },
+      "Metadata": {
+        "aws:cdk:path": "delivlib-test/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role"
+      }
+    },
+    "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "S3Bucket": "cdk-hnb659fds-assets-712950704752-us-east-1",
+          "S3Key": "15684a15d07860e99d2a8079150ad33dd2cb743677fcd7016dd07345e1b69538.zip"
+        },
+        "Timeout": 900,
+        "MemorySize": 128,
+        "Handler": "__entrypoint__.handler",
+        "Role": {
+          "Fn::GetAtt": [
+            "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
+            "Arn"
+          ]
+        },
+        "Runtime": "nodejs12.x",
+        "Description": {
+          "Fn::Join": [
+            "",
+            [
+              "Lambda function for auto-deleting objects in ",
+              {
+                "Ref": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261"
+              },
+              " S3 bucket."
+            ]
+          ]
+        }
+      },
+      "DependsOn": [
+        "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092"
+      ],
+      "Metadata": {
+        "aws:cdk:path": "delivlib-test/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler"
+      }
+    },
     "CodeSignCMKC986BB89": {
       "Type": "AWS::KMS::Key",
       "Properties": {

package/cdk.out/manifest.json

@@ -23,7 +23,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::712950704752:role/cdk-hnb659fds-deploy-role-712950704752-us-east-1",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::712950704752:role/cdk-hnb659fds-cfn-exec-role-712950704752-us-east-1",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-712950704752-us-east-1/3f51b0ef2bfe7d6fc58ae98a3c98325ad21b01b8695757f9f0748ecf98d47289.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-712950704752-us-east-1/c9a95a9366347258da0d2af5ffd2ec969caf38f51888e77082836696d557b5c3.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -891,7 +891,7 @@
               "PipelineProject.onEvent (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:65:22)",
               "PipelineProject.onStateChange (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:101:27)",
               "PipelineProject.onBuildFailed (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:142:27)",
-              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:305:22)",
+              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:311:22)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:85:14)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -952,7 +952,7 @@
               "Topic.grantPublish (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-sns/lib/topic-base.js:65:26)",
               "SnsTopic.bind (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-events-targets/lib/sns.js:34:20)",
               "Rule.addTarget (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-events/lib/rule.js:85:36)",
-              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:305:53)",
+              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:311:53)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:85:14)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -973,7 +973,7 @@
               "new Role (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/role.js:50:22)",
               "new Function (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-lambda/lib/function.js:82:35)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:38:33)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -995,7 +995,7 @@
               "Role.addToPrincipalPolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/role.js:199:34)",
               "Function.addToRolePolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-lambda/lib/function-base.js:55:19)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:47:25)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -1015,7 +1015,7 @@
             "trace": [
               "new Function (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-lambda/lib/function.js:154:26)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:38:33)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -1035,7 +1035,7 @@
             "trace": [
               "new Rule (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-events/lib/rule.js:33:26)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:56:9)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -1059,7 +1059,7 @@
               "Rule.addTarget (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-events/lib/rule.js:85:36)",
               "new Rule (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-events/lib/rule.js:50:18)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:56:9)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -1079,7 +1079,7 @@
             "trace": [
               "new Alarm (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-cloudwatch/lib/alarm.js:103:23)",
               "new PipelineWatcher (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline-watcher/watcher.js:70:22)",
-              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:294:16)",
+              "Pipeline.addFailureAlarm (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:300:16)",
               "new Pipeline (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:83:34)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:43:26)",
               "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
@@ -1165,7 +1165,7 @@
               "Project.onEvent (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:65:22)",
               "Project.onStateChange (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:101:27)",
               "Project.onBuildFailed (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:142:27)",
-              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:305:22)",
+              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:311:22)",
               "Pipeline.addShellable (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:113:18)",
               "Pipeline.addTest (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:118:21)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:56:18)",
@@ -1272,7 +1272,7 @@
               "Project.onEvent (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:65:22)",
               "Project.onStateChange (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:101:27)",
               "Project.onBuildFailed (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:142:27)",
-              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:305:22)",
+              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:311:22)",
               "Pipeline.addShellable (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:113:18)",
               "Pipeline.addTest (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:118:21)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:62:18)",
@@ -1379,7 +1379,7 @@
               "Project.onEvent (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:65:22)",
               "Project.onStateChange (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:101:27)",
               "Project.onBuildFailed (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-codebuild/lib/project.js:142:27)",
-              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:305:22)",
+              "Pipeline.addBuildFailureNotification (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:311:22)",
               "Pipeline.addShellable (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:113:18)",
               "Pipeline.addTest (/home/runner/work/aws-delivlib/aws-delivlib/lib/pipeline.js:118:21)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:72:18)",
@@ -2701,6 +2701,71 @@
             ]
           }
         ],
+        "/delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketD81FB261",
+            "trace": [
+              "new Bucket (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:595:26)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:30)",
+              "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
+              "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
+              "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
+              "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/Policy/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketPolicy8E2DB075",
+            "trace": [
+              "new BucketPolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket-policy.js:37:25)",
+              "Bucket.addToResourcePolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:148:27)",
+              "Bucket.enforceSSLStatement (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:816:14)",
+              "new Bucket (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:631:18)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:30)",
+              "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
+              "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
+              "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
+              "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Bucket/AutoDeleteObjectsCustomResource/Default": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "X509CodeSigningKeyRSAPrivateKeyCertificateSigningRequestBucketAutoDeleteObjectsCustomResource8471F189",
+            "trace": [
+              "new CustomResource (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource.js:42:25)",
+              "Bucket.enableAutoDeleteObjects (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:1103:32)",
+              "new Bucket (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:652:18)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:30)",
+              "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
+              "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
+              "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
+              "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
         "/delivlib-test/X509CodeSigningKey/RSAPrivateKey/CertificateSigningRequest/Resource/Default": [
           {
             "type": "aws:cdk:logicalId",
@@ -2708,7 +2773,7 @@
             "trace": [
               "new CustomResource (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource.js:42:25)",
               "new CustomResource (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-cloudformation/lib/custom-resource.js:63:9)",
-              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:21)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:59:21)",
               "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
               "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
@@ -2851,9 +2916,11 @@
             "trace": [
               "new Policy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/policy.js:50:26)",
               "Role.addToPrincipalPolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/role.js:199:34)",
-              "Role.addToPolicy (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/role.js:207:21)",
-              "RsaPrivateKeySecret.grantGetSecretValue (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:142:17)",
-              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:74:30)",
+              "Function.addToPrincipal (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/grant.js:87:65)",
+              "Function.addToPrincipalOrResource (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-iam/lib/grant.js:43:30)",
+              "Bucket.grant (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:431:31)",
+              "Bucket.grantReadWrite (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:306:21)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:58:22)",
               "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
               "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
               "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
@@ -2889,6 +2956,52 @@
             ]
           }
         ],
+        "/delivlib-test/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
+            "trace": [
+              "new CustomResourceProvider (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource-provider/custom-resource-provider.js:95:22)",
+              "Function.getOrCreateProvider (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource-provider/custom-resource-provider.js:166:94)",
+              "Bucket.enableAutoDeleteObjects (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:1084:56)",
+              "new Bucket (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:652:18)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:30)",
+              "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
+              "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
+              "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
+              "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
+        "/delivlib-test/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
+            "trace": [
+              "new CustomResourceProvider (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource-provider/custom-resource-provider.js:111:25)",
+              "Function.getOrCreateProvider (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/core/lib/custom-resource-provider/custom-resource-provider.js:166:94)",
+              "Bucket.enableAutoDeleteObjects (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:1084:56)",
+              "new Bucket (/home/runner/work/aws-delivlib/aws-delivlib/node_modules/monocdk/lib/aws-s3/lib/bucket.js:652:18)",
+              "new CertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/certificate-signing-request.js:51:30)",
+              "RsaPrivateKeySecret.newCertificateSigningRequest (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/private-key.js:129:16)",
+              "new CodeSigningCertificate (/home/runner/work/aws-delivlib/aws-delivlib/lib/code-signing/code-signing-certificate.js:61:36)",
+              "new TestStack (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/test-stack.js:116:26)",
+              "Object.<anonymous> (/home/runner/work/aws-delivlib/aws-delivlib/lib/__tests__/integ.delivlib.js:29:1)",
+              "Module._compile (node:internal/modules/cjs/loader:1103:14)",
+              "Object.Module._extensions..js (node:internal/modules/cjs/loader:1155:10)",
+              "Module.load (node:internal/modules/cjs/loader:981:32)",
+              "Function.Module._load (node:internal/modules/cjs/loader:822:12)",
+              "Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
+              "node:internal/main/run_main_module:17:47"
+            ]
+          }
+        ],
         "/delivlib-test/CodeSign-CMK/Resource": [
           {
             "type": "aws:cdk:logicalId",