Skip to content

Commit bb380b0

Browse files
13archit13archit
committed
feat: Added example for replica key.
1 parent 0d23637 commit bb380b0

File tree

9 files changed

+363
-16
lines changed

9 files changed

+363
-16
lines changed

‎.github/dependabot.yml‎

Lines changed: 56 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,18 @@
22
# package ecosystems to update and where the package manifests are located.
33
# Please see the documentation for all configuration options:
44
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5-
65
version: 2
76
updates:
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"
11+
open-pull-requests-limit: 3
12+
assignees:
13+
- "clouddrove-ci"
14+
reviewers:
15+
- "approvers"
16+
817
- package-ecosystem: "terraform" # See documentation for possible values
918
directory: "/" # Location of package manifests
1019
schedule:
@@ -15,13 +24,57 @@ updates:
1524
# Add reviewer
1625
reviewers:
1726
- "approvers"
27+
# Allow up to 3 open pull requests for pip dependencies
28+
open-pull-requests-limit: 3
29+
30+
- package-ecosystem: "terraform" # See documentation for possible values
31+
directory: "/_example/complete" # Location of package manifests
32+
schedule:
33+
interval: "weekly"
34+
# Add assignees
35+
assignees:
36+
- "clouddrove-ci"
37+
# Add reviewer
38+
reviewers:
39+
- "approvers"
40+
# Allow up to 3 open pull requests for pip dependencies
41+
open-pull-requests-limit: 3
42+
1843
- package-ecosystem: "terraform" # See documentation for possible values
19-
directory: "_example/" # Location of package manifests
44+
directory: "/_example/external_key" # Location of package manifests
2045
schedule:
2146
interval: "weekly"
2247
# Add assignees
2348
assignees:
2449
- "clouddrove-ci"
2550
# Add reviewer
2651
reviewers:
27-
- "approvers"
52+
- "approvers"
53+
# Allow up to 3 open pull requests for pip dependencies
54+
open-pull-requests-limit: 3
55+
56+
- package-ecosystem: "terraform" # See documentation for possible values
57+
directory: "/_example/external_replica_key" # Location of package manifests
58+
schedule:
59+
interval: "weekly"
60+
# Add assignees
61+
assignees:
62+
- "clouddrove-ci"
63+
# Add reviewer
64+
reviewers:
65+
- "approvers"
66+
# Allow up to 3 open pull requests for pip dependencies
67+
open-pull-requests-limit: 3
68+
69+
- package-ecosystem: "terraform" # See documentation for possible values
70+
directory: "/_example/replica_key" # Location of package manifests
71+
schedule:
72+
interval: "weekly"
73+
# Add assignees
74+
assignees:
75+
- "clouddrove-ci"
76+
# Add reviewer
77+
reviewers:
78+
- "approvers"
79+
# Allow up to 3 open pull requests for pip dependencies
80+
open-pull-requests-limit: 3

‎.github/workflows/tf-checks.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,12 @@ jobs:
1212
external_key:
1313
uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master
1414
with:
15-
working_directory: './_example/external_key/'
15+
working_directory: './_example/external_key/'
16+
external_replica_key:
17+
uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master
18+
with:
19+
working_directory: './_example/external_replica_key/'
20+
replica_key:
21+
uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master
22+
with:
23+
working_directory: './_example/replica_key/'

‎README.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,19 @@ github_repo: clouddrove/terraform-aws-kms
1515

1616
# Badges to display
1717
badges:
18-
- name: "Terraform"
19-
image: "https://img.shields.io/badge/Terraform-v1.1.7-green"
20-
url: "https://www.terraform.io"
18+
- name: "Latest Release"
19+
image: "https://img.shields.io/github/release/clouddrove/terraform-aws-subnet.svg"
20+
url: "https://github.com/clouddrove/terraform-aws-subnet/releases/latest"
21+
- name: "tfsec"
22+
image: "https://github.com/clouddrove/terraform-aws-subnet/actions/workflows/tfsec.yml/badge.svg"
23+
url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml"
2124
- name: "Licence"
2225
image: "https://img.shields.io/badge/License-APACHE-blue.svg"
2326
url: "LICENSE.md"
24-
- name: "tfsec"
25-
image: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml/badge.svg"
26-
url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml"
27-
- name: "static-checks"
28-
image: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/terraform.yml/badge.svg"
29-
url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/terraform.yml"
3027

28+
prerequesties:
29+
- name: Terraform 1.5.4
30+
url: https://learn.hashicorp.com/terraform/getting-started/install.html
3131
# description of this project
3232
description: |-
3333
This terraform module creates a KMS Customer Master Key (CMK) and its alias.

‎_example/external_replica_key/example.tf‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
####----------------------------------------------------------------------------------
2+
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
3+
####----------------------------------------------------------------------------------
4+
provider "aws" {
5+
region = "us-east-1"
6+
}
7+
8+
####----------------------------------------------------------------------------------
9+
## AWS External KMS Key Replica.
10+
## Should be deployed in different region as of primary key.
11+
####----------------------------------------------------------------------------------
12+
module "kms_key" {
13+
source = "./../../"
14+
name = "kms"
15+
environment = "test"
16+
deletion_window_in_days = 7
17+
alias = "alias/replicate_key"
18+
kms_key_enabled = false
19+
create_replica_external_enabled = true
20+
enabled = true
21+
multi_region = false
22+
key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
23+
primary_key_arn = "arn:aws:kms:xxxxxxxxxxxxxxxxxxxxx"
24+
policy = data.aws_iam_policy_document.default.json
25+
}
26+
27+
data "aws_caller_identity" "current" {}
28+
data "aws_partition" "current" {}
29+
30+
##----------------------------------------------------------------------------------
31+
## Data block called to get Permissions that will be used in creating policy.
32+
##----------------------------------------------------------------------------------
33+
data "aws_iam_policy_document" "default" {
34+
version = "2012-10-17"
35+
statement {
36+
sid = "Enable IAM User Permissions"
37+
effect = "Allow"
38+
principals {
39+
type = "AWS"
40+
identifiers = [
41+
format(
42+
"arn:%s:iam::%s:root",
43+
join("", data.aws_partition.current.*.partition),
44+
data.aws_caller_identity.current.account_id
45+
)
46+
]
47+
}
48+
actions = ["kms:*"]
49+
resources = ["*"]
50+
}
51+
statement {
52+
sid = "Allow CloudTrail to encrypt logs"
53+
effect = "Allow"
54+
principals {
55+
type = "Service"
56+
identifiers = ["cloudtrail.amazonaws.com"]
57+
}
58+
actions = ["kms:GenerateDataKey*"]
59+
resources = ["*"]
60+
condition {
61+
test = "StringLike"
62+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
63+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
64+
}
65+
}
66+
67+
statement {
68+
sid = "Allow CloudTrail to describe key"
69+
effect = "Allow"
70+
principals {
71+
type = "Service"
72+
identifiers = ["cloudtrail.amazonaws.com"]
73+
}
74+
actions = ["kms:DescribeKey"]
75+
resources = ["*"]
76+
}
77+
78+
statement {
79+
sid = "Allow principals in the account to decrypt log files"
80+
effect = "Allow"
81+
principals {
82+
type = "AWS"
83+
identifiers = [
84+
format(
85+
"arn:%s:iam::%s:root",
86+
join("", data.aws_partition.current.*.partition),
87+
data.aws_caller_identity.current.account_id
88+
)
89+
]
90+
}
91+
actions = [
92+
"kms:Decrypt",
93+
"kms:ReEncryptFrom"
94+
]
95+
resources = ["*"]
96+
condition {
97+
test = "StringEquals"
98+
variable = "kms:CallerAccount"
99+
values = [
100+
"XXXXXXXXXXXX"]
101+
}
102+
condition {
103+
test = "StringLike"
104+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
105+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
106+
}
107+
}
108+
109+
statement {
110+
sid = "Allow alias creation during setup"
111+
effect = "Allow"
112+
principals {
113+
type = "AWS"
114+
identifiers = [
115+
format(
116+
"arn:%s:iam::%s:root",
117+
join("", data.aws_partition.current.*.partition),
118+
data.aws_caller_identity.current.account_id
119+
)
120+
]
121+
}
122+
actions = ["kms:CreateAlias"]
123+
resources = ["*"]
124+
}
125+
}

‎_example/external_replica_key/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "key_arn" {
2+
value = module.kms_key.key_arn
3+
description = "Key ARN."
4+
}
5+
6+
output "tags" {
7+
value = module.kms_key.tags
8+
description = "A mapping of tags to assign to the KMS."
9+
}
10+
11+
output "key_id" {
12+
value = module.kms_key.key_id
13+
description = "The globally unique identifier for the key."
14+
}
15+
16+
output "target_key_id" {
17+
value = module.kms_key.target_key_id
18+
description = "Identifier for the key for which the alias is for, can be either an ARN or key_id."
19+
}

0 commit comments

Comments
 (0)