Merge 941c296 into b1fe391

ministryofjustice · Dec 3, 2024 · 46b1820 · 46b1820
2 parents b1fe391 + 941c296
commit 46b1820
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 14 deletions.
diff --git a/...orm/account/kms_key_event_recieved_sqs.tf → ...orm/account/kms_key_event_received_sqs.tf b/...orm/account/kms_key_event_recieved_sqs.tf → ...orm/account/kms_key_event_received_sqs.tf
@@ -41,7 +41,7 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms" {
     principals {
       type = "AWS"
       identifiers = [
-        local.account.account_name == "development" ? "arn:aws:iam::${data.aws_caller_identity.global.account_id}:root" : "arn:aws:iam::${data.aws_caller_identity.global.account_id}:role/event-received-${local.account.account_name}",
+        "events.amazonaws.com",
       ]
     }
   }
@@ -123,13 +123,14 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms" {
   }
 
   statement {
-    sid    = "Allow Breakglass to Decrypt"
+    sid    = "Allow Breakglass to use key"
     effect = "Allow"
     resources = [
       "arn:aws:kms:*:${data.aws_caller_identity.global.account_id}:key/*"
     ]
     actions = [
       "kms:Decrypt",
+      "kms:Encrypt*",
       "kms:GenerateDataKey*",
       "kms:DescribeKey",
     ]
@@ -155,6 +156,8 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms_development_account_opera
       "kms:Create*",
       "kms:Describe*",
       "kms:Enable*",
+      "kms:Encrypt",
+      "kms:ReEncrypt*",
       "kms:List*",
       "kms:Put*",
       "kms:Update*",

diff --git a/terraform/environment/region/modules/event_received/main.tf b/terraform/environment/region/modules/event_received/main.tf
@@ -34,16 +34,16 @@ module "event_received" {
   }
 }
 
-# data "aws_kms_alias" "sqs" {
-#   name     = "alias/${data.aws_default_tags.current.tags.application}_sqs_secret_encryption_key"
-#   provider = aws.region
-# }
+data "aws_kms_alias" "event_received_sqs" {
+  name     = "alias/${data.aws_default_tags.current.tags.application}_event_recieved_sqs_secret_encryption_key"
+  provider = aws.region
+}
 
 #tfsec:ignore:aws-sqs-enable-queue-encryption:exp:2024-11-24
 resource "aws_sqs_queue" "receive_events_queue" {
-  name = "${data.aws_default_tags.current.tags.environment-name}-receive-events-queue"
-  # kms_master_key_id                 = data.aws_kms_alias.sqs.target_key_id
-  # kms_data_key_reuse_period_seconds = 300
+  name                              = "${data.aws_default_tags.current.tags.environment-name}-receive-events-queue"
+  kms_master_key_id                 = data.aws_kms_alias.event_received_sqs.target_key_id
+  kms_data_key_reuse_period_seconds = 300
 
   visibility_timeout_seconds = 300
   redrive_policy = jsonencode({
@@ -81,10 +81,10 @@ data "aws_iam_policy_document" "receive_events_queue_policy" {
 
 #tfsec:ignore:aws-sqs-enable-queue-encryption:exp:2024-11-24
 resource "aws_sqs_queue" "receive_events_deadletter" {
-  name = "${data.aws_default_tags.current.tags.environment-name}-receive-events-deadletter"
-  # kms_master_key_id                 = data.aws_kms_alias.sqs.target_key_id
-  # kms_data_key_reuse_period_seconds = 300
-  provider = aws.region
+  name                              = "${data.aws_default_tags.current.tags.environment-name}-receive-events-deadletter"
+  kms_master_key_id                 = data.aws_kms_alias.event_received_sqs.target_key_id
+  kms_data_key_reuse_period_seconds = 300
+  provider                          = aws.region
 }
 
 resource "aws_sqs_queue_redrive_allow_policy" "receive_events_redrive_allow_policy" {
@@ -281,7 +281,7 @@ data "aws_iam_policy_document" "event_received" {
       data.aws_kms_alias.secrets_manager_secret_encryption_key.target_key_arn,
       data.aws_kms_alias.aws_lambda.target_key_arn,
       data.aws_kms_alias.jwt_key.target_key_arn,
-      # data.aws_kms_alias.sqs.target_key_arn,
+      data.aws_kms_alias.event_received_sqs.target_key_arn,
     ]
 
     actions = [