Skip to content

Commit fd30b44

Browse files
yadavprakashyadavprakash
authored
Merge pull request #28 from clouddrove/issue-451
update readme.yaml according new example and version.tf
2 parents 62688e6 + ed524c9 commit fd30b44

File tree

6 files changed

+214
-104
lines changed

6 files changed

+214
-104
lines changed

‎README.yaml‎

Lines changed: 96 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -47,88 +47,115 @@ usage : |-
4747
name = "kms"
4848
environment = "test"
4949
label_order = ["name", "environment"]
50-
enabled = true
51-
description = "KMS key for cloudtrail"
50+
5251
deletion_window_in_days = 7
53-
enable_key_rotation = true
54-
alias = "alias/cloudtrail"
52+
alias = "alias/cloudtrail_Name"
53+
enabled = true
54+
kms_key_enabled = true
55+
multi_region = true
56+
create_external_enabled = true
57+
valid_to = "2023-11-21T23:20:50Z"
58+
key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
5559
policy = data.aws_iam_policy_document.default.json
5660
}
57-
58-
data "aws_iam_policy_document" "default" {
61+
62+
data "aws_caller_identity" "current" {}
63+
data "aws_partition" "current" {}
64+
65+
##----------------------------------------------------------------------------------
66+
## Data block called to get Permissions that will be used in creating policy.
67+
##----------------------------------------------------------------------------------
68+
data "aws_iam_policy_document" "default" {
5969
version = "2012-10-17"
6070
statement {
61-
sid = "Enable IAM User Permissions"
62-
effect = "Allow"
63-
principals {
64-
type = "AWS"
65-
identifiers = ["*"]
66-
}
67-
actions = ["kms:*"]
68-
resources = ["*"]
71+
sid = "Enable IAM User Permissions"
72+
effect = "Allow"
73+
principals {
74+
type = "AWS"
75+
identifiers = [
76+
format(
77+
"arn:%s:iam::%s:root",
78+
join("", data.aws_partition.current.*.partition),
79+
data.aws_caller_identity.current.account_id
80+
)
81+
]
82+
}
83+
actions = ["kms:*"]
84+
resources = ["*"]
6985
}
7086
statement {
71-
sid = "Allow CloudTrail to encrypt logs"
72-
effect = "Allow"
73-
principals {
74-
type = "Service"
75-
identifiers = ["cloudtrail.amazonaws.com"]
76-
}
77-
actions = ["kms:GenerateDataKey*"]
78-
resources = ["*"]
79-
condition {
80-
test = "StringLike"
81-
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
82-
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
83-
}
87+
sid = "Allow CloudTrail to encrypt logs"
88+
effect = "Allow"
89+
principals {
90+
type = "Service"
91+
identifiers = ["cloudtrail.amazonaws.com"]
8492
}
85-
93+
actions = ["kms:GenerateDataKey*"]
94+
resources = ["*"]
95+
condition {
96+
test = "StringLike"
97+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
98+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
99+
}
100+
}
101+
86102
statement {
87-
sid = "Allow CloudTrail to describe key"
88-
effect = "Allow"
89-
principals {
90-
type = "Service"
91-
identifiers = ["cloudtrail.amazonaws.com"]
92-
}
93-
actions = ["kms:DescribeKey"]
94-
resources = ["*"]
103+
sid = "Allow CloudTrail to describe key"
104+
effect = "Allow"
105+
principals {
106+
type = "Service"
107+
identifiers = ["cloudtrail.amazonaws.com"]
95108
}
96-
109+
actions = ["kms:DescribeKey"]
110+
resources = ["*"]
111+
}
112+
97113
statement {
98-
sid = "Allow principals in the account to decrypt log files"
99-
effect = "Allow"
100-
principals {
101-
type = "AWS"
102-
identifiers = ["*"]
103-
}
104-
actions = [
105-
"kms:Decrypt",
106-
"kms:ReEncryptFrom"
107-
]
108-
resources = ["*"]
109-
condition {
110-
test = "StringEquals"
111-
variable = "kms:CallerAccount"
112-
values = [
113-
"XXXXXXXXXXXX"]
114-
}
115-
condition {
116-
test = "StringLike"
117-
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
118-
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
119-
}
114+
sid = "Allow principals in the account to decrypt log files"
115+
effect = "Allow"
116+
principals {
117+
type = "AWS"
118+
identifiers = [
119+
format(
120+
"arn:%s:iam::%s:root",
121+
join("", data.aws_partition.current.*.partition),
122+
data.aws_caller_identity.current.account_id
123+
)
124+
]
120125
}
121-
126+
actions = [
127+
"kms:Decrypt",
128+
"kms:ReEncryptFrom"
129+
]
130+
resources = ["*"]
131+
condition {
132+
test = "StringEquals"
133+
variable = "kms:CallerAccount"
134+
values = [
135+
"XXXXXXXXXXXX"]
136+
}
137+
condition {
138+
test = "StringLike"
139+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
140+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
141+
}
142+
}
143+
122144
statement {
123-
sid = "Allow alias creation during setup"
124-
effect = "Allow"
125-
principals {
126-
type = "AWS"
127-
identifiers = ["*"]
128-
}
129-
actions = ["kms:CreateAlias"]
130-
resources = ["*"]
145+
sid = "Allow alias creation during setup"
146+
effect = "Allow"
147+
principals {
148+
type = "AWS"
149+
identifiers = [
150+
format(
151+
"arn:%s:iam::%s:root",
152+
join("", data.aws_partition.current.*.partition),
153+
data.aws_caller_identity.current.account_id
154+
)
155+
]
156+
}
157+
actions = ["kms:CreateAlias"]
158+
resources = ["*"]
131159
}
132160
}
133-
134161
```

‎_example/example.tf‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,40 @@
1+
####----------------------------------------------------------------------------------
2+
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
3+
####----------------------------------------------------------------------------------
4+
5+
16
provider "aws" {
2-
region = "eu-west-1"
7+
region = "us-east-1"
38
}
4-
data "aws_caller_identity" "current" {}
5-
data "aws_partition" "current" {}
69

10+
####----------------------------------------------------------------------------------
11+
## AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the cryptographic keys that are used to protect your data.
12+
####----------------------------------------------------------------------------------
713
module "kms_key" {
14+
815
source = "./../"
916

1017
name = "kms"
1118
environment = "test"
1219
label_order = ["name", "environment"]
1320

14-
enabled = true
15-
description = "KMS key for cloudtrail"
16-
deletion_window_in_days = 15
21+
deletion_window_in_days = 7
1722
alias = "alias/cloudtrail_Name"
18-
multi_region = false
23+
enabled = true
24+
kms_key_enabled = true
25+
multi_region = true
26+
create_external_enabled = true
27+
valid_to = "2023-11-21T23:20:50Z"
28+
key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
1929
policy = data.aws_iam_policy_document.default.json
2030
}
2131

32+
data "aws_caller_identity" "current" {}
33+
data "aws_partition" "current" {}
34+
35+
##----------------------------------------------------------------------------------
36+
## Data block called to get Permissions that will be used in creating policy.
37+
##----------------------------------------------------------------------------------
2238
data "aws_iam_policy_document" "default" {
2339
version = "2012-10-17"
2440
statement {
@@ -111,4 +127,4 @@ data "aws_iam_policy_document" "default" {
111127
actions = ["kms:CreateAlias"]
112128
resources = ["*"]
113129
}
114-
}
130+
}

‎main.tf‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
1-
## Managed By : CloudDrove
2-
# Description : This Script is used to create KMS on AWS.
3-
## Copyright @ CloudDrove. All Right Reserved.
4-
5-
#Module : labels
6-
#Description : This terraform module is designed to generate consistent label names and tags
7-
# for resources. You can use terraform-labels to implement a strict naming
8-
# convention.
1+
##----------------------------------------------------------------------------------
2+
## Labels module callled that will be used for naming and tags.
3+
##----------------------------------------------------------------------------------
94
module "labels" {
105
source = "clouddrove/labels/aws"
116
version = "1.3.0"
@@ -16,10 +11,12 @@ module "labels" {
1611
label_order = var.label_order
1712
}
1813

19-
# Module : KMS KEY
20-
# Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
14+
####----------------------------------------------------------------------------------
15+
## This terraform resource creates a KMS Customer Master Key (CMK) and its alias.
16+
####----------------------------------------------------------------------------------
2117
resource "aws_kms_key" "default" {
22-
count = var.enabled ? 1 : 0
18+
count = var.enabled && var.kms_key_enabled ? 1 : 0
19+
2320
description = var.description
2421
key_usage = var.key_usage
2522
deletion_window_in_days = var.deletion_window_in_days
@@ -31,10 +28,30 @@ resource "aws_kms_key" "default" {
3128
tags = module.labels.tags
3229
}
3330

34-
# Module : KMS ALIAS
35-
# Description : Provides an alias for a KMS customer master key..
31+
####----------------------------------------------------------------------------------
32+
## Create KMS keys in an external key store backed by your cryptographic keys outside of AWS.
33+
####----------------------------------------------------------------------------------
34+
resource "aws_kms_external_key" "external" {
35+
count = var.enabled && var.create_external_enabled ? 1 : 0
36+
37+
bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check
38+
deletion_window_in_days = var.deletion_window_in_days
39+
description = var.description
40+
enabled = var.is_enabled
41+
key_material_base64 = var.key_material_base64
42+
multi_region = var.multi_region
43+
policy = var.policy
44+
valid_to = var.valid_to
45+
46+
tags = module.labels.tags
47+
}
48+
49+
##----------------------------------------------------------------------------------
50+
## Provides an alias for a KMS customer master key.
51+
##----------------------------------------------------------------------------------
3652
resource "aws_kms_alias" "default" {
37-
count = var.enabled ? 1 : 0
53+
count = var.enabled ? 1 : 0
54+
3855
name = coalesce(var.alias, format("alias/%v", module.labels.id))
3956
target_key_id = join("", aws_kms_key.default.*.id)
40-
}
57+
}

‎outputs.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
# Module : KMS KEY
2-
# Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
31
output "key_arn" {
42
value = join("", aws_kms_key.default.*.arn)
53
description = "Key ARN."

‎variables.tf‎

Lines changed: 59 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,11 @@ variable "enabled" {
6767
default = true
6868
description = "Specifies whether the kms is enabled or disabled."
6969
}
70+
variable "kms_key_enabled" {
71+
type = bool
72+
default = true
73+
description = "Specifies whether the kms is enabled or disabled."
74+
}
7075

7176

7277
variable "key_usage" {
@@ -82,13 +87,6 @@ variable "alias" {
8287
description = "The display name of the alias. The name must start with the word `alias` followed by a forward slash."
8388
}
8489

85-
variable "policy" {
86-
type = string
87-
default = ""
88-
sensitive = true
89-
description = "A valid policy JSON document. For more information about building AWS IAM policy documents with Terraform."
90-
}
91-
9290
variable "customer_master_key_spec" {
9391
type = string
9492
default = "SYMMETRIC_DEFAULT"
@@ -107,3 +105,57 @@ variable "multi_region" {
107105
default = true
108106
description = "Indicates whether the KMS key is a multi-Region (true) or regional (false) key."
109107
}
108+
109+
variable "bypass_policy_lockout_safety_check" {
110+
type = bool
111+
default = null
112+
description = "A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable"
113+
}
114+
115+
variable "valid_to" {
116+
type = string
117+
default = ""
118+
description = "Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire"
119+
}
120+
121+
variable "key_material_base64" {
122+
type = string
123+
default = null
124+
description = "Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. External key only"
125+
}
126+
127+
variable "create_external_enabled" {
128+
type = bool
129+
default = false
130+
description = "Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material)"
131+
}
132+
133+
variable "primary_external_key_arn" {
134+
type = string
135+
default = null
136+
description = "The primary external key arn of a multi-region replica external key"
137+
}
138+
139+
variable "primary_key_arn" {
140+
type = string
141+
default = ""
142+
description = "The primary key arn of a multi-region replica key"
143+
}
144+
145+
variable "policy" {
146+
type = string
147+
default = null
148+
description = "A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used"
149+
}
150+
151+
variable "computed_aliases" {
152+
description = "A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources"
153+
type = any
154+
default = {}
155+
}
156+
157+
variable "aliases_use_name_prefix" {
158+
description = "Determines whether the alias name is used as a prefix"
159+
type = bool
160+
default = false
161+
}

0 commit comments

Comments
 (0)