xpk/terraform.examples
SHA256
1
0
Fork 0
Code Pull Requests Activity

feat: updated key policy for database

Browse Source
This commit is contained in:
xpk
2026-02-26 08:49:26 +08:00
parent 7c3ba0aab8
commit 53271833ef
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf
+7 -5
View File
@@ -60,11 +60,11 @@ resource "aws_kms_key" "eks_ebs" {
resource "aws_kms_key" "database" { resource "aws_kms_key" "database" {
count = var.create-database-key ? 1 : 0 count = var.create-database-key ? 1 : 0
description = "Customer-managed KMS key for encrypting cloud databases such as RDS and Elasticache" description = "Customer-managed KMS key for encrypting cloud databases such as RDS, Elasticache, DynamoDB"
enable_key_rotation = var.enable_key_rotation enable_key_rotation = var.enable_key_rotation
rotation_period_in_days = var.rotation_period_in_days rotation_period_in_days = var.rotation_period_in_days
is_enabled = var.is_enabled is_enabled = var.is_enabled
policy = data.aws_iam_policy_document.rds.json policy = data.aws_iam_policy_document.database.json
deletion_window_in_days = var.deletion_window_in_days deletion_window_in_days = var.deletion_window_in_days
customer_master_key_spec = "SYMMETRIC_DEFAULT" customer_master_key_spec = "SYMMETRIC_DEFAULT"
key_usage = "ENCRYPT_DECRYPT" key_usage = "ENCRYPT_DECRYPT"
@@ -266,7 +266,7 @@ data "aws_iam_policy_document" "storage" {
} }
} }
data "aws_iam_policy_document" "rds" { data "aws_iam_policy_document" "database" {
source_policy_documents = [data.aws_iam_policy_document.base.json] source_policy_documents = [data.aws_iam_policy_document.base.json]
statement { statement {
sid = "Allow use by AWS services" sid = "Allow use by AWS services"
@@ -280,7 +280,8 @@ data "aws_iam_policy_document" "rds" {
"kms:Decrypt", "kms:Decrypt",
"kms:ReEncrypt*", "kms:ReEncrypt*",
"kms:GenerateDataKey*", "kms:GenerateDataKey*",
"kms:Describe*" "kms:Describe*",
"kms:CreateGrant"
] ]
resources = ["*"] resources = ["*"]
condition { condition {
@@ -288,7 +289,8 @@ data "aws_iam_policy_document" "rds" {
values = [ values = [
"rds.*.amazonaws.com", "rds.*.amazonaws.com",
"elasticache.*.amazonaws.com", "elasticache.*.amazonaws.com",
"dax.*.amazonaws.com" "dax.*.amazonaws.com",
"dynamodb.*.amazonaws.com"
] ]
variable = "kms:ViaService" variable = "kms:ViaService"
} }