Skip to content

Commit 0b1ba7c

Browse files
clouddrove-ciclouddrove-ci
committed
update README.md
1 parent fd30b44 commit 0b1ba7c

File tree

1 file changed

+106
-70
lines changed

1 file changed

+106
-70
lines changed

‎README.md‎

Lines changed: 106 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -83,90 +83,117 @@ Here is an example of how you can use this module in your inventory structure:
8383
name = "kms"
8484
environment = "test"
8585
label_order = ["name", "environment"]
86-
enabled = true
87-
description = "KMS key for cloudtrail"
86+
8887
deletion_window_in_days = 7
89-
enable_key_rotation = true
90-
alias = "alias/cloudtrail"
88+
alias = "alias/cloudtrail_Name"
89+
enabled = true
90+
kms_key_enabled = true
91+
multi_region = true
92+
create_external_enabled = true
93+
valid_to = "2023-11-21T23:20:50Z"
94+
key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
9195
policy = data.aws_iam_policy_document.default.json
9296
}
93-
94-
data "aws_iam_policy_document" "default" {
97+
98+
data "aws_caller_identity" "current" {}
99+
data "aws_partition" "current" {}
100+
101+
##----------------------------------------------------------------------------------
102+
## Data block called to get Permissions that will be used in creating policy.
103+
##----------------------------------------------------------------------------------
104+
data "aws_iam_policy_document" "default" {
95105
version = "2012-10-17"
96106
statement {
97-
sid = "Enable IAM User Permissions"
98-
effect = "Allow"
99-
principals {
100-
type = "AWS"
101-
identifiers = ["*"]
102-
}
103-
actions = ["kms:*"]
104-
resources = ["*"]
107+
sid = "Enable IAM User Permissions"
108+
effect = "Allow"
109+
principals {
110+
type = "AWS"
111+
identifiers = [
112+
format(
113+
"arn:%s:iam::%s:root",
114+
join("", data.aws_partition.current.*.partition),
115+
data.aws_caller_identity.current.account_id
116+
)
117+
]
118+
}
119+
actions = ["kms:*"]
120+
resources = ["*"]
105121
}
106122
statement {
107-
sid = "Allow CloudTrail to encrypt logs"
108-
effect = "Allow"
109-
principals {
110-
type = "Service"
111-
identifiers = ["cloudtrail.amazonaws.com"]
112-
}
113-
actions = ["kms:GenerateDataKey*"]
114-
resources = ["*"]
115-
condition {
116-
test = "StringLike"
117-
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
118-
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
119-
}
123+
sid = "Allow CloudTrail to encrypt logs"
124+
effect = "Allow"
125+
principals {
126+
type = "Service"
127+
identifiers = ["cloudtrail.amazonaws.com"]
120128
}
121-
129+
actions = ["kms:GenerateDataKey*"]
130+
resources = ["*"]
131+
condition {
132+
test = "StringLike"
133+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
134+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
135+
}
136+
}
137+
122138
statement {
123-
sid = "Allow CloudTrail to describe key"
124-
effect = "Allow"
125-
principals {
126-
type = "Service"
127-
identifiers = ["cloudtrail.amazonaws.com"]
128-
}
129-
actions = ["kms:DescribeKey"]
130-
resources = ["*"]
139+
sid = "Allow CloudTrail to describe key"
140+
effect = "Allow"
141+
principals {
142+
type = "Service"
143+
identifiers = ["cloudtrail.amazonaws.com"]
131144
}
132-
145+
actions = ["kms:DescribeKey"]
146+
resources = ["*"]
147+
}
148+
133149
statement {
134-
sid = "Allow principals in the account to decrypt log files"
135-
effect = "Allow"
136-
principals {
137-
type = "AWS"
138-
identifiers = ["*"]
139-
}
140-
actions = [
141-
"kms:Decrypt",
142-
"kms:ReEncryptFrom"
143-
]
144-
resources = ["*"]
145-
condition {
146-
test = "StringEquals"
147-
variable = "kms:CallerAccount"
148-
values = [
149-
"XXXXXXXXXXXX"]
150-
}
151-
condition {
152-
test = "StringLike"
153-
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
154-
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
155-
}
150+
sid = "Allow principals in the account to decrypt log files"
151+
effect = "Allow"
152+
principals {
153+
type = "AWS"
154+
identifiers = [
155+
format(
156+
"arn:%s:iam::%s:root",
157+
join("", data.aws_partition.current.*.partition),
158+
data.aws_caller_identity.current.account_id
159+
)
160+
]
156161
}
157-
162+
actions = [
163+
"kms:Decrypt",
164+
"kms:ReEncryptFrom"
165+
]
166+
resources = ["*"]
167+
condition {
168+
test = "StringEquals"
169+
variable = "kms:CallerAccount"
170+
values = [
171+
"XXXXXXXXXXXX"]
172+
}
173+
condition {
174+
test = "StringLike"
175+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
176+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
177+
}
178+
}
179+
158180
statement {
159-
sid = "Allow alias creation during setup"
160-
effect = "Allow"
161-
principals {
162-
type = "AWS"
163-
identifiers = ["*"]
164-
}
165-
actions = ["kms:CreateAlias"]
166-
resources = ["*"]
181+
sid = "Allow alias creation during setup"
182+
effect = "Allow"
183+
principals {
184+
type = "AWS"
185+
identifiers = [
186+
format(
187+
"arn:%s:iam::%s:root",
188+
join("", data.aws_partition.current.*.partition),
189+
data.aws_caller_identity.current.account_id
190+
)
191+
]
192+
}
193+
actions = ["kms:CreateAlias"]
194+
resources = ["*"]
167195
}
168196
}
169-
170197
```
171198

172199

@@ -179,22 +206,31 @@ Here is an example of how you can use this module in your inventory structure:
179206
| Name | Description | Type | Default | Required |
180207
|------|-------------|------|---------|:--------:|
181208
| alias | The display name of the alias. The name must start with the word `alias` followed by a forward slash. | `string` | `""` | no |
209+
| aliases\_use\_name\_prefix | Determines whether the alias name is used as a prefix | `bool` | `false` | no |
182210
| attributes | Additional attributes (e.g. `1`). | `list(string)` | `[]` | no |
211+
| bypass\_policy\_lockout\_safety\_check | A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable | `bool` | `null` | no |
212+
| computed\_aliases | A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources | `any` | `{}` | no |
213+
| create\_external\_enabled | Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material) | `bool` | `false` | no |
183214
| customer\_master\_key\_spec | Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC\_DEFAULT, RSA\_2048, RSA\_3072, RSA\_4096, ECC\_NIST\_P256, ECC\_NIST\_P384, ECC\_NIST\_P521, or ECC\_SECG\_P256K1. Defaults to SYMMETRIC\_DEFAULT. | `string` | `"SYMMETRIC_DEFAULT"` | no |
184215
| deletion\_window\_in\_days | Duration in days after which the key is deleted after destruction of the resource. | `number` | `10` | no |
185216
| description | The description of the key as viewed in AWS console. | `string` | `"Parameter Store KMS master key"` | no |
186217
| enable\_key\_rotation | Specifies whether key rotation is enabled. | `string` | `true` | no |
187218
| enabled | Specifies whether the kms is enabled or disabled. | `bool` | `true` | no |
188219
| environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no |
189220
| is\_enabled | Specifies whether the key is enabled. | `bool` | `true` | no |
221+
| key\_material\_base64 | Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only | `string` | `null` | no |
190222
| key\_usage | Specifies the intended use of the key. Defaults to ENCRYPT\_DECRYPT, and only symmetric encryption and decryption are supported. | `string` | `"ENCRYPT_DECRYPT"` | no |
223+
| kms\_key\_enabled | Specifies whether the kms is enabled or disabled. | `bool` | `true` | no |
191224
| label\_order | label order, e.g. `name`,`application`. | `list(any)` | `[]` | no |
192225
| managedby | ManagedBy, eg 'CloudDrove'. | `string` | `"[email protected]"` | no |
193226
| multi\_region | Indicates whether the KMS key is a multi-Region (true) or regional (false) key. | `bool` | `true` | no |
194227
| name | Name (e.g. `app` or `cluster`). | `string` | `""` | no |
195-
| policy | A valid policy JSON document. For more information about building AWS IAM policy documents with Terraform. | `string` | `""` | no |
228+
| policy | A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used | `string` | `null` | no |
229+
| primary\_external\_key\_arn | The primary external key arn of a multi-region replica external key | `string` | `null` | no |
230+
| primary\_key\_arn | The primary key arn of a multi-region replica key | `string` | `""` | no |
196231
| repository | Terraform current module repo | `string` | `"https://github.com/clouddrove/terraform-aws-kms"` | no |
197232
| tags | Additional tags (e.g. map(`BusinessUnit`,`XYZ`). | `map(string)` | `{}` | no |
233+
| valid\_to | Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire | `string` | `""` | no |
198234

199235
## Outputs
200236

0 commit comments

Comments
 (0)