-
Notifications
You must be signed in to change notification settings - Fork 0
/
kms.tf
50 lines (50 loc) · 1.53 KB
/
kms.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key
resource "aws_kms_key" "encryption_rest" {
enable_key_rotation = true
description = "Key to encrypt Amazon CloudWatch logs at rest."
deletion_window_in_days = 7
#checkov:skip=CKV2_AWS_64: KMS Key policy in a separate resource
}
#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias
resource "aws_kms_alias" "encryption_rest" {
name = "alias/lambda-${var.name}-at-rest"
target_key_id = aws_kms_key.encryption_rest.key_id
}
#https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key_policy
resource "aws_kms_key_policy" "encryption_rest_policy" {
key_id = aws_kms_key.encryption_rest.id
policy = jsonencode({
Id = "encryption-rest"
Statement = [
{
Action = "kms:*"
Effect = "Allow"
Principal = {
AWS = "${local.principal_root_arn}"
}
Resource = "*"
Sid = "Enable IAM User Permissions"
},
{
Effect : "Allow",
Principal : {
Service : "${local.principal_logs_arn}"
},
Action : [
"kms:Encrypt*",
"kms:Decrypt*",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:Describe*"
],
Resource : "*",
Condition : {
ArnEquals : {
"kms:EncryptionContext:aws:logs:arn" : [local.cloudwatch_log_group_arn]
}
}
}
]
Version = "2012-10-17"
})
}