743 lines
22 KiB
Terraform
743 lines
22 KiB
Terraform
/**
|
|
* # CustomerManagedKmsKeys
|
|
*
|
|
* Module to create the following CMKs:
|
|
* - allpurpose
|
|
* - storage
|
|
* - database
|
|
* - secrets
|
|
* - backup
|
|
* - log
|
|
* - notify
|
|
*/
|
|
|
|
data "aws_region" "this" {}
|
|
data "aws_caller_identity" "current" {}
|
|
|
|
# Keys
|
|
resource "aws_kms_key" "allpurpose" {
|
|
count = var.create-allpurpose-key ? 1 : 0
|
|
description = "All purpose customer-managed KMS key"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.UseOfKeyByAll.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "storage" {
|
|
count = var.create-storage-key ? 1 : 0
|
|
description = "Customer-managed KMS key for encrypting cloud storage such as EBS and S3"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.storage.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
# Key use for EBS volumes on EKS nodes
|
|
resource "aws_kms_key" "eks_ebs" {
|
|
count = var.create-eksebs-key ? 1 : 0
|
|
description = "CMK for use with EBS volumes on EKS nodes"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.eksebs[0].json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "database" {
|
|
count = var.create-database-key ? 1 : 0
|
|
description = "Customer-managed KMS key for encrypting cloud databases such as RDS and Elasticache"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.rds.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "secret" {
|
|
count = var.create-secret-key ? 1 : 0
|
|
description = "Customer-managed KMS key for encrypting secrets"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.UseOfKeyByAll.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "backup" {
|
|
count = var.create-backup-key ? 1 : 0
|
|
description = "Customer-managed KMS key for encrypting backup data"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.backup.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "log" {
|
|
count = var.create-log-key ? 1 : 0
|
|
description = "Customer-managed KMS key for cloudwatch logs and cloudtrail"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.log.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
resource "aws_kms_key" "notify" {
|
|
count = var.create-notify-key ? 1 : 0
|
|
description = "Customer-managed KMS key for encrypting notifications"
|
|
enable_key_rotation = var.enable_key_rotation
|
|
rotation_period_in_days = var.rotation_period_in_days
|
|
is_enabled = var.is_enabled
|
|
policy = data.aws_iam_policy_document.notify.json
|
|
deletion_window_in_days = var.deletion_window_in_days
|
|
customer_master_key_spec = "SYMMETRIC_DEFAULT"
|
|
key_usage = "ENCRYPT_DECRYPT"
|
|
multi_region = var.multi_region
|
|
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
|
|
}
|
|
|
|
|
|
locals {
|
|
prefix = var.name-prefix == null ? "" : "${var.name-prefix}-"
|
|
}
|
|
|
|
# Key aliases
|
|
resource "aws_kms_alias" "allpurpose" {
|
|
count = var.create-allpurpose-key ? 1 : 0
|
|
name = "alias/${local.prefix}allpurpose"
|
|
target_key_id = aws_kms_key.allpurpose[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "storage" {
|
|
count = var.create-storage-key ? 1 : 0
|
|
name = "alias/${local.prefix}storage"
|
|
target_key_id = aws_kms_key.storage[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "eks_ebs" {
|
|
count = var.create-eksebs-key ? 1 : 0
|
|
name = "alias/${local.prefix}eksebs"
|
|
target_key_id = aws_kms_key.eks_ebs[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "database" {
|
|
count = var.create-database-key ? 1 : 0
|
|
name = "alias/${local.prefix}database"
|
|
target_key_id = aws_kms_key.database[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "backup" {
|
|
count = var.create-backup-key ? 1 : 0
|
|
name = "alias/${local.prefix}backup"
|
|
target_key_id = aws_kms_key.backup[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "secret" {
|
|
count = var.create-secret-key ? 1 : 0
|
|
name = "alias/${local.prefix}secret"
|
|
target_key_id = aws_kms_key.secret[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "log" {
|
|
count = var.create-log-key ? 1 : 0
|
|
name = "alias/${local.prefix}log"
|
|
target_key_id = aws_kms_key.log[0].id
|
|
}
|
|
|
|
resource "aws_kms_alias" "notify" {
|
|
count = var.create-notify-key ? 1 : 0
|
|
name = "alias/${local.prefix}notify"
|
|
target_key_id = aws_kms_key.notify[0].id
|
|
}
|
|
|
|
# Policies
|
|
data "aws_iam_policy_document" "storage" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "Allow use by AWS services"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [
|
|
"delivery.logs.amazonaws.com" # vpc flow log
|
|
]
|
|
type = "Service"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
statement {
|
|
sid = "Allow use of key by s3 and ec2"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [data.aws_caller_identity.current.account_id]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "StringEquals"
|
|
values = [
|
|
"ec2.${data.aws_region.this.id}.amazonaws.com",
|
|
"s3.${data.aws_region.this.id}.amazonaws.com"
|
|
]
|
|
variable = "kms:ViaService"
|
|
}
|
|
}
|
|
# this needs to be explicitly allowed for users and roles to be able to encrypt and decrypt data
|
|
statement {
|
|
sid = "Allow use of key by users and roles in same account"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [data.aws_caller_identity.current.account_id]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "AllowAttachmentOfPersistentResources"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:CreateGrant",
|
|
"kms:ListGrants",
|
|
"kms:RevokeGrant"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "Bool"
|
|
values = ["true"]
|
|
variable = "kms:GrantIsForAWSResource"
|
|
}
|
|
}
|
|
}
|
|
|
|
data "aws_iam_policy_document" "rds" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "Allow use by AWS services"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "StringEquals"
|
|
values = [
|
|
"rds.${data.aws_region.this.id}.amazonaws.com",
|
|
"elasticache.${data.aws_region.this.id}.amazonaws.com",
|
|
"dax.${data.aws_region.this.id}.amazonaws.com"
|
|
]
|
|
variable = "kms:ViaService"
|
|
}
|
|
}
|
|
|
|
statement {
|
|
sid = "AllowAttachmentOfPersistentResources"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:CreateGrant",
|
|
"kms:ListGrants",
|
|
"kms:RevokeGrant"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "Bool"
|
|
values = ["true"]
|
|
variable = "kms:GrantIsForAWSResource"
|
|
}
|
|
}
|
|
}
|
|
|
|
# create an ASG service linked role if not already exist
|
|
data "aws_iam_roles" "autoscaling" {
|
|
count = var.create_asg_role ? 0 : 1
|
|
name_regex = "^AWSServiceRoleForAutoScaling$"
|
|
}
|
|
|
|
resource "aws_iam_service_linked_role" "autoscaling" {
|
|
count = var.create_asg_role ? 1 : 0
|
|
aws_service_name = "autoscaling.amazonaws.com"
|
|
description = "Service-linked role for AutoScaling"
|
|
}
|
|
|
|
locals {
|
|
AsgServiceRoleArn = try(aws_iam_service_linked_role.autoscaling[0].arn, one(data.aws_iam_roles.autoscaling[0].arns))
|
|
}
|
|
|
|
output "debug" {
|
|
value = local.AsgServiceRoleArn
|
|
}
|
|
|
|
data "aws_iam_policy_document" "eksebs" {
|
|
count = var.create-eksebs-key ? 1 : 0
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "Allow use by EKS"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [
|
|
local.AsgServiceRoleArn
|
|
]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "Allow grants by EKS"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [
|
|
local.AsgServiceRoleArn
|
|
]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:RevokeGrant",
|
|
"kms:ListGrants",
|
|
"kms:CreateGrant"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "Bool"
|
|
values = ["true"]
|
|
variable = "kms:GrantIsForAWSResource"
|
|
}
|
|
}
|
|
}
|
|
|
|
data "aws_iam_policy_document" "notify" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "Allow use by AWS services"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [
|
|
"logs.${data.aws_region.this.id}.amazonaws.com", # cloudwatch log groups
|
|
"backup.amazonaws.com", # Notifications
|
|
"events.amazonaws.com" # Notifications
|
|
]
|
|
type = "Service"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
}
|
|
|
|
data "aws_iam_policy_document" "log" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "Allow use by AWS services"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = [
|
|
"logs.${data.aws_region.this.id}.amazonaws.com", # cloudwatch log groups
|
|
"apigateway.${data.aws_region.this.id}.amazonaws.com", # api gateway
|
|
"delivery.logs.amazonaws.com", # vpc flow log
|
|
"cloudtrail.amazonaws.com" # cloudtrail
|
|
]
|
|
type = "Service"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:Describe*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
}
|
|
|
|
# policy for awsbackup: https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html
|
|
data "aws_iam_policy_document" "backup" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "KmsPermissions"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:ListKeys",
|
|
"kms:DescribeKey",
|
|
"kms:GenerateDataKey",
|
|
"kms:ListAliases"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "KmsCreateGrantPermissions"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:CreateGrant",
|
|
"kms:ListGrants",
|
|
"kms:RevokeGrant"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "ForAnyValue:StringEquals"
|
|
values = ["aws:backup:backup-vault"]
|
|
variable = "kms:EncryptionContextKeys"
|
|
}
|
|
condition {
|
|
test = "Bool"
|
|
values = [true]
|
|
variable = "kms:GrantIsForAWSResource"
|
|
}
|
|
condition {
|
|
test = "StringLike"
|
|
values = ["backup.*.amazonaws.com"]
|
|
variable = "kms:ViaService"
|
|
}
|
|
}
|
|
}
|
|
|
|
# allow all entities in this account to perform encryption and decryption
|
|
data "aws_iam_policy_document" "UseOfKeyByAll" {
|
|
source_policy_documents = [data.aws_iam_policy_document.base.json]
|
|
statement {
|
|
sid = "AllowUseOfKey"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:DescribeKey"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "StringEquals"
|
|
values = [data.aws_caller_identity.current.account_id]
|
|
variable = "aws:PrincipalAccount"
|
|
}
|
|
}
|
|
statement {
|
|
sid = "AllowAttachmentOfPersistentResources"
|
|
effect = "Allow"
|
|
principals {
|
|
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
type = "AWS"
|
|
}
|
|
actions = [
|
|
"kms:CreateGrant",
|
|
"kms:ListGrants",
|
|
"kms:RevokeGrant"
|
|
]
|
|
resources = ["*"]
|
|
condition {
|
|
test = "Bool"
|
|
values = ["true"]
|
|
variable = "kms:GrantIsForAWSResource"
|
|
}
|
|
}
|
|
}
|
|
|
|
# base policies allowing full access to key admin and read access to all
|
|
data "aws_iam_policy_document" "base" {
|
|
source_policy_documents = [jsonencode(
|
|
{
|
|
"Id" : "CmkBasePolicy",
|
|
"Version" : "2012-10-17",
|
|
"Statement" : [
|
|
{
|
|
"Sid" : "ReadPermissonForAll",
|
|
"Effect" : "Allow",
|
|
"Principal" : {
|
|
"AWS" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
|
|
},
|
|
"Action" : [
|
|
"kms:DescribeKey",
|
|
"kms:GetKeyPolicy",
|
|
"kms:ListAliases",
|
|
"kms:ListKeyPolicies",
|
|
"kms:ListKeys",
|
|
"kms:ListResourceTags"
|
|
],
|
|
"Resource" : "*"
|
|
},
|
|
{
|
|
"Sid" : "KeyAdministratorsAccess",
|
|
"Effect" : "Allow",
|
|
"Principal" : {
|
|
"AWS" : var.key_administrator_arn != null ? var.key_administrator_arn : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
|
|
},
|
|
"Action" : [
|
|
"kms:Create*",
|
|
"kms:Describe*",
|
|
"kms:Enable*",
|
|
"kms:List*",
|
|
"kms:Put*",
|
|
"kms:Update*",
|
|
"kms:Revoke*",
|
|
"kms:Disable*",
|
|
"kms:Get*",
|
|
"kms:Delete*",
|
|
"kms:TagResource",
|
|
"kms:UntagResource",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:CancelKeyDeletion",
|
|
"kms:RotateKeyOnDemand"
|
|
],
|
|
"Resource" : "*"
|
|
}
|
|
]
|
|
}
|
|
)]
|
|
}
|
|
|
|
# data "aws_iam_policy_document" "this" {
|
|
# source_policy_documents = var.source_policy_documents
|
|
# override_policy_documents = var.override_policy_documents
|
|
#
|
|
# # Default policy - account wide access to all key operations
|
|
# dynamic "statement" {
|
|
# for_each = var.enable_default_policy ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "Default"
|
|
# actions = ["kms:*"]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# # Key owner - all key operations
|
|
# dynamic "statement" {
|
|
# for_each = var.enable_default_policy ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "KeyOwner"
|
|
# actions = ["kms:*"]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = var.key_owners
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# # Key administrators - https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators
|
|
# dynamic "statement" {
|
|
# for_each = length(var.key_administrators) > 0 ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "KeyAdministration"
|
|
# actions = [
|
|
# "kms:Create*",
|
|
# "kms:Describe*",
|
|
# "kms:Enable*",
|
|
# "kms:List*",
|
|
# "kms:Put*",
|
|
# "kms:Update*",
|
|
# "kms:Revoke*",
|
|
# "kms:Disable*",
|
|
# "kms:Get*",
|
|
# "kms:Delete*",
|
|
# "kms:TagResource",
|
|
# "kms:UntagResource",
|
|
# "kms:ScheduleKeyDeletion",
|
|
# "kms:CancelKeyDeletion",
|
|
# ]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = var.key_administrators
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# # Key users - https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users
|
|
# dynamic "statement" {
|
|
# for_each = length(var.key_users) > 0 ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "KeyUsage"
|
|
# actions = [
|
|
# "kms:Encrypt",
|
|
# "kms:Decrypt",
|
|
# "kms:ReEncrypt*",
|
|
# "kms:GenerateDataKey*",
|
|
# "kms:DescribeKey",
|
|
# ]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = var.key_users
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# # Key service users - https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration
|
|
# dynamic "statement" {
|
|
# for_each = length(var.key_service_users) > 0 ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "KeyServiceUsage"
|
|
# actions = [
|
|
# "kms:CreateGrant",
|
|
# "kms:ListGrants",
|
|
# "kms:RevokeGrant",
|
|
# ]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = var.key_service_users
|
|
# }
|
|
#
|
|
# condition {
|
|
# test = "Bool"
|
|
# variable = "kms:GrantIsForAWSResource"
|
|
# values = [true]
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# # Key cryptographic operations - https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto
|
|
# dynamic "statement" {
|
|
# for_each = length(var.key_symmetric_encryption_users) > 0 ? [1] : []
|
|
#
|
|
# content {
|
|
# sid = "KeySymmetricEncryption"
|
|
# actions = [
|
|
# "kms:Decrypt",
|
|
# "kms:DescribeKey",
|
|
# "kms:Encrypt",
|
|
# "kms:GenerateDataKey*",
|
|
# "kms:ReEncrypt*",
|
|
# ]
|
|
# resources = ["*"]
|
|
#
|
|
# principals {
|
|
# type = "AWS"
|
|
# identifiers = var.key_symmetric_encryption_users
|
|
# }
|
|
# }
|
|
# }
|
|
# }
|
|
|
|
# ################################################################################
|
|
# # Grant
|
|
# ################################################################################
|
|
#
|
|
# resource "aws_kms_grant" "this" {
|
|
# for_each = { for k, v in var.grants : k => v if var.create }
|
|
#
|
|
# name = try(each.value.name, each.key)
|
|
# key_id = aws_kms_key.this[0].key_id
|
|
# grantee_principal = each.value.grantee_principal
|
|
# operations = each.value.operations
|
|
#
|
|
# dynamic "constraints" {
|
|
# for_each = length(lookup(each.value, "constraints", {})) == 0 ? [] : [each.value.constraints]
|
|
#
|
|
# content {
|
|
# encryption_context_equals = try(constraints.value.encryption_context_equals, null)
|
|
# encryption_context_subset = try(constraints.value.encryption_context_subset, null)
|
|
# }
|
|
# }
|
|
#
|
|
# retiring_principal = try(each.value.retiring_principal, null)
|
|
# grant_creation_tokens = try(each.value.grant_creation_tokens, null)
|
|
# retire_on_delete = try(each.value.retire_on_delete, null)
|
|
# }
|