What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

We're trying to use the MongoDB Atlas CDK constructs to create a project with encryption at rest using a customer managed KMS key. However it appears that it's impossible to do that with one cdk deploy. It seems to require a separate step to create the trust policy and cloud provider authorization in MongoDB Atlas Console. It appears that terraform has this capability via the cloud_provider_access_authorization resource.

Is it possible to have a similar CDK construct so that we can deploy new projects to new accounts/regions without a manual step and configuration change in between?

What would you like to see happen?

Describe the desired outcome or enhancement.

A new CDK construct that would configure cloud provider access to do CMK in AWS for project data encryption at rest.

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

Not having this complicates our deployments to new AWS accounts and regions and requires manual operator intervention. This complicates and slows disaster recovery and rollout to new accounts.

What steps, if any, are you taking today to manage this problem?

We do a two stage deploy, one to provision the keys and roles, and another to set up the encryption at rest. In between we need to go to the console to set up the trust policy between Atlas and our AWS account.