feat: added key for ssm

modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf

@@ -9,6 +9,7 @@
 * - backup
 * - log
 * - notify
+* - ssm
 */
 
 data "aws_region" "this" {}
@@ -128,6 +129,19 @@ resource "aws_kms_key" "notify" {
   bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
 }
 
+resource "aws_kms_key" "notify" {
+  count                              = var.create-ssm-key ? 1 : 0
+  description                        = "Customer-managed KMS key for encrypting ssm parameters"
+  enable_key_rotation                = var.enable_key_rotation
+  rotation_period_in_days            = var.rotation_period_in_days
+  is_enabled                         = var.is_enabled
+  policy                             = data.aws_iam_policy_document.ssm.json
+  deletion_window_in_days            = var.deletion_window_in_days
+  customer_master_key_spec           = "SYMMETRIC_DEFAULT"
+  key_usage                          = "ENCRYPT_DECRYPT"
+  multi_region                       = var.multi_region
+  bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
+}
 
 locals {
   prefix = var.name-prefix == null ? "" : "${var.name-prefix}-"
@@ -579,6 +593,31 @@ data "aws_iam_policy_document" "base" {
   )]
 }
 
+data "aws_iam_policy_document" "ssm" {
+  source_policy_documents = [data.aws_iam_policy_document.base.json]
+  statement {
+    sid    = "Allow access through SSM for all principals in the account that are authorized to use SSM"
+    effect = "Allow"
+    principals {
+      identifiers = [data.aws_caller_identity.current.account_id]
+      type        = "AWS"
+    }
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:DescribeKey"
+    ]
+    resources = ["*"]
+    condition {
+      test     = "StringLike"
+      values   = ["ssm.*.amazonaws.com"]
+      variable = "kms:ViaService"
+    }
+  }
+}
+
 # data "aws_iam_policy_document" "this" {
 #   source_policy_documents   = var.source_policy_documents
 #   override_policy_documents = var.override_policy_documents