Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MLPAB-2613 - Fix event received SQS KMC CMK permissions #1660

Merged
merged 2 commits into from
Dec 3, 2024
Merged

MLPAB-2613 - Fix event received SQS KMC CMK permissions #1660

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
af11afa
fix key name and replace to ensure correct policy is attached
andrewpearce-digital Dec 3, 2024
7fcba0e
fix statements
andrewpearce-digital Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 64 additions & 10 deletions terraform/account/kms_key_event_recieved_sqs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
module "event_recieved_sqs_kms" {
module "event_received_sqs_kms" {
source = "./modules/kms_key"
encrypted_resource = "SQS"
kms_key_alias_name = "${local.default_tags.application}_event_recieved_sqs_secret_encryption_key"
kms_key_alias_name = "${local.default_tags.application}_event_received_sqs_secret_encryption_key"
enable_key_rotation = true
enable_multi_region = true
deletion_window_in_days = 10
kms_key_policy = local.account.account_name == "development" ? data.aws_iam_policy_document.event_recieved_sqs_kms_merged.json : data.aws_iam_policy_document.event_recieved_sqs_kms.json
kms_key_policy = local.account.account_name == "development" ? data.aws_iam_policy_document.event_received_sqs_kms_merged.json : data.aws_iam_policy_document.event_received_sqs_kms.json
providers = {
aws.eu_west_1 = aws.eu_west_1
aws.eu_west_2 = aws.eu_west_2
Expand All @@ -14,25 +14,39 @@ module "event_recieved_sqs_kms" {

# See the following link for further information
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
data "aws_iam_policy_document" "event_recieved_sqs_kms_merged" {
data "aws_iam_policy_document" "event_received_sqs_kms_merged" {
provider = aws.global
source_policy_documents = [
data.aws_iam_policy_document.sqs_kms.json,
data.aws_iam_policy_document.event_recieved_sqs_kms_development_account_operator_admin.json
data.aws_iam_policy_document.event_received_sqs_kms_development_account_operator_admin.json
]
}

data "aws_iam_policy_document" "event_recieved_sqs_kms" {
data "aws_iam_policy_document" "event_received_sqs_kms" {
provider = aws.global
statement {
sid = "Allow Key to be used for Encryption"
sid = "Enable IAM User Permissions"
effect = "Allow"
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${data.aws_caller_identity.global.account_id}:root"]
}
actions = [
"kms:*",
]
resources = [
"*",
]
}

statement {
sid = "Allow Encryption by IAM"
effect = "Allow"
resources = [
"arn:aws:kms:*:${data.aws_caller_identity.global.account_id}:key/*"
]
actions = [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
Expand All @@ -45,9 +59,29 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms" {
]
}
}
statement {
sid = "Allow Encryption by Service"
effect = "Allow"
resources = [
"arn:aws:kms:*:${data.aws_caller_identity.global.account_id}:key/*"
]
actions = [
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
]

principals {
type = "Service"
identifiers = [
"events.amazonaws.com",
]
}
}

statement {
sid = "Allow Key to be used for Decryption"
sid = "Allow Decryption by Service"
effect = "Allow"
resources = [
"arn:aws:kms:*:${data.aws_caller_identity.global.account_id}:key/*"
Expand All @@ -68,6 +102,26 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms" {
}
}

statement {
sid = "Allow Decryption by IAM"
effect = "Allow"
resources = [
"arn:aws:kms:*:${data.aws_caller_identity.global.account_id}:key/*"
]
actions = [
"kms:Decrypt",
"kms:GenerateDataKey*",
"kms:DescribeKey",
]

principals {
type = "AWS"
identifiers = [
local.account.account_name == "development" ? "arn:aws:iam::${data.aws_caller_identity.global.account_id}:root" : "arn:aws:iam::${data.aws_caller_identity.global.account_id}:role/event-received-${local.account.account_name}",
]
}
}

statement {
sid = "General View Access"
effect = "Allow"
Expand Down Expand Up @@ -143,7 +197,7 @@ data "aws_iam_policy_document" "event_recieved_sqs_kms" {
}
}

data "aws_iam_policy_document" "event_recieved_sqs_kms_development_account_operator_admin" {
data "aws_iam_policy_document" "event_received_sqs_kms_development_account_operator_admin" {
provider = aws.global
statement {
sid = "Dev Account Key Administrator"
Expand Down
Loading