From 7c3ba0aab85b38f3aab86f88d48b72bd7b5f61828920dca5c7f94762c32fd84e Mon Sep 17 00:00:00 2001
From: xpk <xpk@headdesk.me>
Date: Thu, 26 Feb 2026 08:35:04 +0800
Subject: [PATCH] feat: updated key policy for storage

---
 .../CustomerManagedKmsKeys/main.tf                 | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf b/modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf
index 9d348de..b143f3e 100644
--- a/modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf
+++ b/modules/security_identity_compliance/CustomerManagedKmsKeys/main.tf
@@ -219,10 +219,10 @@ data "aws_iam_policy_document" "storage" {
     ]
     resources = ["*"]
     condition {
-      test = "StringEquals"
+      test = "StringLike"
       values = [
-        "ec2.${data.aws_region.this.id}.amazonaws.com",
-        "s3.${data.aws_region.this.id}.amazonaws.com"
+        "ec2.*.amazonaws.com",
+        "s3.*.amazonaws.com"
       ]
       variable = "kms:ViaService"
     }
@@ -284,11 +284,11 @@ data "aws_iam_policy_document" "rds" {
     ]
     resources = ["*"]
     condition {
-      test = "StringEquals"
+      test = "StringLike"
       values = [
-        "rds.${data.aws_region.this.id}.amazonaws.com",
-        "elasticache.${data.aws_region.this.id}.amazonaws.com",
-        "dax.${data.aws_region.this.id}.amazonaws.com"
+        "rds.*.amazonaws.com",
+        "elasticache.*.amazonaws.com",
+        "dax.*.amazonaws.com"
       ]
       variable = "kms:ViaService"
     }