MLPAB-2202 - Refactor KMS resources into a module (#1333)

* createe a module to creatre kms keys

* output alias name from module

* use module for cloudwatch kms key

terraform/account/cloudwatch_kms.tf

@@ -1,30 +1,15 @@
-resource "aws_kms_key" "cloudwatch" {
-  description             = "${local.default_tags.application} Cloudwatch application logs encryption key"
-  deletion_window_in_days = 10
+module "cloudwatch_kms" {
+  source                  = "./modules/kms_key"
+  encrypted_resource      = "Cloudwatch application logs"
+  kms_key_alias_name      = "${local.default_tags.application}_cloudwatch_application_logs_encryption"
   enable_key_rotation     = true
-  policy                  = local.account.account_name == "development" ? data.aws_iam_policy_document.cloudwatch_kms_merged.json : data.aws_iam_policy_document.cloudwatch_kms.json
-  multi_region            = true
-  provider                = aws.eu_west_1
-}
-
-resource "aws_kms_replica_key" "cloudwatch_replica" {
-  description             = "${local.default_tags.application} Cloudwatch application logs Multi-Region replica key"
-  deletion_window_in_days = 7
-  primary_key_arn         = aws_kms_key.cloudwatch.arn
-  policy                  = local.account.account_name == "development" ? data.aws_iam_policy_document.cloudwatch_kms_merged.json : data.aws_iam_policy_document.cloudwatch_kms.json
-  provider                = aws.eu_west_2
-}
-
-resource "aws_kms_alias" "cloudwatch_alias_eu_west_1" {
-  name          = "alias/${local.default_tags.application}_cloudwatch_application_logs_encryption"
-  target_key_id = aws_kms_key.cloudwatch.key_id
-  provider      = aws.eu_west_1
-}
-
-resource "aws_kms_alias" "cloudwatch_alias_eu_west_2" {
-  name          = "alias/${local.default_tags.application}_cloudwatch_application_logs_encryption"
-  target_key_id = aws_kms_replica_key.cloudwatch_replica.key_id
-  provider      = aws.eu_west_2
+  enable_multi_region     = true
+  deletion_window_in_days = 10
+  kms_key_policy          = local.account.account_name == "development" ? data.aws_iam_policy_document.cloudwatch_kms_merged.json : data.aws_iam_policy_document.cloudwatch_kms.json
+  providers = {
+    aws.eu_west_1 = aws.eu_west_1
+    aws.eu_west_2 = aws.eu_west_2
+  }
 }
 
 # See the following link for further information

terraform/account/modules/kms_key/data_sources.tf

@@ -0,0 +1,3 @@
+data "aws_default_tags" "current" {
+  provider = aws.eu_west_1
+}

terraform/account/modules/kms_key/kms_key.tf

@@ -0,0 +1,28 @@
+resource "aws_kms_key" "main" {
+  description             = "${data.aws_default_tags.current.tags.application} ${var.encrypted_resource} encryption key"
+  deletion_window_in_days = var.deletion_window_in_days
+  enable_key_rotation     = var.enable_key_rotation
+  policy                  = var.kms_key_policy
+  multi_region            = var.enable_multi_region
+  provider                = aws.eu_west_1
+}
+
+resource "aws_kms_replica_key" "main" {
+  description             = "${data.aws_default_tags.current.tags.application} ${var.encrypted_resource} multi-region replica key"
+  deletion_window_in_days = var.deletion_window_in_days
+  primary_key_arn         = aws_kms_key.main.arn
+  policy                  = var.kms_key_policy
+  provider                = aws.eu_west_2
+}
+
+resource "aws_kms_alias" "main_eu_west_1" {
+  name          = "alias/${var.kms_key_alias_name}"
+  target_key_id = aws_kms_key.main.key_id
+  provider      = aws.eu_west_1
+}
+
+resource "aws_kms_alias" "main_eu_west_2" {
+  name          = "alias/${var.kms_key_alias_name}"
+  target_key_id = aws_kms_replica_key.main.key_id
+  provider      = aws.eu_west_2
+}

terraform/account/modules/kms_key/outputs.tf

@@ -0,0 +1,3 @@
+output "kms_key_alias_name" {
+  value = aws_kms_alias.main_eu_west_1.name
+}

terraform/account/modules/kms_key/variables.tf

@@ -0,0 +1,32 @@
+variable "kms_key_policy" {
+  type        = string
+  description = "Policy json to attach to the KMS key and replica key."
+}
+
+variable "encrypted_resource" {
+  type        = string
+  description = "The resource that will be encrypted by the KMS key."
+}
+
+variable "kms_key_alias_name" {
+  type        = string
+  description = "The alias name for the KMS key."
+}
+
+variable "enable_key_rotation" {
+  type        = bool
+  description = "Whether to enable key rotation for the KMS key."
+  default     = true
+}
+
+variable "enable_multi_region" {
+  type        = bool
+  description = "Whether to enable multi-region replication for the KMS key."
+  default     = true
+}
+
+variable "deletion_window_in_days" {
+  type        = number
+  description = "The number of days to retain the KMS key before it is deleted."
+  default     = 10
+}

terraform/account/modules/kms_key/versions.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.57.0"
+      configuration_aliases = [
+        aws.eu_west_1,
+        aws.eu_west_2,
+      ]
+    }
+    pagerduty = {
+      source  = "PagerDuty/pagerduty"
+      version = "3.14.5"
+    }
+  }
+  required_version = "1.9.1"
+}

terraform/account/refactoring.tf

@@ -2,3 +2,23 @@ moved {
   from = module.eu_west_1.aws_backup_vault.main
   to   = aws_backup_vault.eu_west_1
 }
+
+moved {
+  from = aws_kms_key.cloudwatch
+  to   = module.cloudwatch_kms.aws_kms_key.main
+}
+
+moved {
+  from = aws_kms_replica_key.cloudwatch_replica
+  to   = module.cloudwatch_kms.aws_kms_replica_key.main
+}
+
+moved {
+  from = aws_kms_alias.cloudwatch_alias_eu_west_1
+  to   = module.cloudwatch_kms.aws_kms_alias.main_eu_west_1
+}
+
+moved {
+  from = aws_kms_alias.cloudwatch_alias_eu_west_2
+  to   = module.cloudwatch_kms.aws_kms_alias.main_eu_west_2
+}

terraform/account/regions.tf

@@ -2,7 +2,7 @@ module "eu_west_1" {
   source                                                   = "./region"
   count                                                    = contains(local.account.regions, "eu-west-1") ? 1 : 0
   network_cidr_block                                       = "10.162.0.0/16"
-  cloudwatch_log_group_kms_key_alias                       = aws_kms_alias.cloudwatch_alias_eu_west_1.name
+  cloudwatch_log_group_kms_key_alias                       = module.cloudwatch_kms.kms_key_alias_name
   sns_kms_key_alias                                        = aws_kms_alias.sns_alias_eu_west_1.name
   secrets_manager_kms_key_alias                            = aws_kms_alias.secrets_manager_alias_eu_west_1.name
   reduced_fees_uploads_s3_encryption_kms_key_alias         = aws_kms_alias.reduced_fees_uploads_s3_alias_eu_west_1.name
@@ -18,7 +18,7 @@ module "eu_west_2" {
   source                                                   = "./region"
   count                                                    = contains(local.account.regions, "eu-west-2") ? 1 : 0
   network_cidr_block                                       = "10.162.0.0/16"
-  cloudwatch_log_group_kms_key_alias                       = aws_kms_alias.cloudwatch_alias_eu_west_2.name
+  cloudwatch_log_group_kms_key_alias                       = module.cloudwatch_kms.kms_key_alias_name
   sns_kms_key_alias                                        = aws_kms_alias.sns_alias_eu_west_2.name
   secrets_manager_kms_key_alias                            = aws_kms_alias.secrets_manager_alias_eu_west_2.name
   reduced_fees_uploads_s3_encryption_kms_key_alias         = aws_kms_alias.reduced_fees_uploads_s3_alias_eu_west_2.name