give av scan lambda permission to decrypt objects (#785)

ministryofjustice · Oct 19, 2023 · 05098d9 · 05098d9
1 parent 45e8b8d
commit 05098d9
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/terraform/environment/region/modules/s3_antivirus/data_sources.tf b/terraform/environment/region/modules/s3_antivirus/data_sources.tf
@@ -10,3 +10,8 @@ data "aws_caller_identity" "current" {
 data "aws_default_tags" "current" {
   provider = aws.region
 }
+
+data "aws_kms_alias" "uploads_encryption_key" {
+  name     = "alias/${data.aws_default_tags.current.tags.application}_reduced_fees_uploads_s3_encryption"
+  provider = aws.region
+}
diff --git a/terraform/environment/region/modules/s3_antivirus/iam.tf b/terraform/environment/region/modules/s3_antivirus/iam.tf
@@ -29,6 +29,16 @@ data "aws_iam_policy_document" "lambda" {
     ]
   }
 
+  statement {
+    sid       = "allowS3ObjectDecryption"
+    effect    = "Allow"
+    resources = [data.aws_kms_alias.uploads_encryption_key.target_key_arn]
+    actions = [
+      "kms:Decrypt",
+      "kms:DescribeKey"
+    ]
+  }
+
   statement {
     sid       = "allowVirusDefinitions"
     effect    = "Allow"