-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for global clusters (#7)
* Add support for global clusters * Add full support for global cluster
- Loading branch information
1 parent
7d13fe3
commit ac21bc2
Showing
10 changed files
with
471 additions
and
118 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,109 @@ | ||
| data "aws_iam_policy_document" "rds" { | ||
| statement { | ||
| sid = "Enable IAM User Permissions" | ||
|
|
||
| actions = ["kms:*"] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "AWS" | ||
| identifiers = [ | ||
| "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", | ||
| data.aws_caller_identity.current.arn | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| statement { | ||
| sid = "Allow use of the key" | ||
|
|
||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey" | ||
| ] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "Service" | ||
| identifiers = [ | ||
| "rds.amazonaws.com", | ||
| "monitoring.rds.amazonaws.com" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "cloudwatch" { | ||
| statement { | ||
| sid = "Enable IAM User Permissions" | ||
|
|
||
| actions = ["kms:*"] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "AWS" | ||
| identifiers = [ | ||
| "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", | ||
| data.aws_caller_identity.current.arn | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| statement { | ||
| sid = "Allow use of the key" | ||
|
|
||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey" | ||
| ] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "Service" | ||
| identifiers = [ | ||
| "logs.${data.aws_region.current.name}.amazonaws.com" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| ############# | ||
| # KMS key | ||
| ############# | ||
| module "kms" { | ||
| source = "umotif-public/kms/aws" | ||
| version = "~> 1.0" | ||
|
|
||
| alias_name = "rds-kms-test-key" | ||
| deletion_window_in_days = 7 | ||
| enable_key_rotation = true | ||
| policy = data.aws_iam_policy_document.rds.json | ||
|
|
||
| tags = { | ||
| Environment = "test" | ||
| } | ||
| } | ||
|
|
||
| module "kms-cloudwatch" { | ||
| source = "umotif-public/kms/aws" | ||
| version = "~> 1.0" | ||
|
|
||
| alias_name = "cloudwatch-kms-test-key" | ||
| deletion_window_in_days = 7 | ||
| enable_key_rotation = true | ||
| policy = data.aws_iam_policy_document.cloudwatch.json | ||
|
|
||
| tags = { | ||
| Environment = "test" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| data "aws_iam_policy_document" "rds" { | ||
| statement { | ||
| sid = "Enable IAM User Permissions" | ||
|
|
||
| actions = ["kms:*"] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "AWS" | ||
| identifiers = [ | ||
| "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", | ||
| data.aws_caller_identity.current.arn | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| statement { | ||
| sid = "Allow use of the key" | ||
|
|
||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey" | ||
| ] | ||
|
|
||
| resources = ["*"] | ||
|
|
||
| principals { | ||
| type = "Service" | ||
| identifiers = [ | ||
| "rds.amazonaws.com", | ||
| "monitoring.rds.amazonaws.com" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| module "kms-ireland" { | ||
| source = "umotif-public/kms/aws" | ||
| version = "~> 1.0" | ||
|
|
||
| providers = { | ||
| aws = aws.primary | ||
| } | ||
|
|
||
| alias_name = "global-rds-kms-test-key" | ||
| deletion_window_in_days = 7 | ||
| enable_key_rotation = true | ||
| policy = data.aws_iam_policy_document.rds.json | ||
|
|
||
|
|
||
| tags = { | ||
| Environment = "test" | ||
| } | ||
| } | ||
|
|
||
| module "kms-london" { | ||
| source = "umotif-public/kms/aws" | ||
| version = "~> 1.0" | ||
|
|
||
| providers = { | ||
| aws = aws.secondary | ||
| } | ||
|
|
||
| alias_name = "global-rds-kms-test-key" | ||
| deletion_window_in_days = 7 | ||
| enable_key_rotation = true | ||
| policy = data.aws_iam_policy_document.rds.json | ||
|
|
||
| tags = { | ||
| Environment = "test" | ||
| } | ||
| } |
Oops, something went wrong.