AWS KMS Terraform Module

Description

Dependencies

Resource List

Code Updates

Deployment Steps

Usage

terraform {required_providers {aws={      source="hashicorp/aws"      version="=4.58"    }  }}#this can be called in region setupmodule"kms" {source="github.com/Coalfire-CF/ACE-AWS-KMS?ref=vX.X.X"resource_prefix=var.resource_prefixkms_key_resource_type="s3"key_policy=data.aws_iam_policy_document.s3_kms_policy.json}#this should be created where the module is called within the project. such as in region-setup or account setup if desired.data"aws_iam_policy_document""s3_kms_policy" {statement {sid="source-account-full-access"effect="Allow"actions=["kms:*"]resources=["*"]principals {type="AWS"identifiers=["arn:aws:iam::${var.mgmt_account_id}:root"]    }  }statement {sid="target-account-allow-grant"effect="Allow"# the following actions are required by Terraform to read/create/remove grantsactions=["kms:CreateGrant","kms:DescribeKey","kms:ListGrants","kms:RevokeGrant"    ]resources=["*"]# This allows any IAM role in the target account that has permission to create the grant to create the grant.# Can lock this down to a specific account in the target account so only that role is able to create grant for this keyprincipals {type="AWS"identifiers=["arn:aws:iam::${var.app_account_id}:root"]    }  }# Resource to be called where KMS access is required by a resource/service deploymentresource"aws_kms_grant""cross-account-grant" {name="grant-s3-kms-key"key_id=module.kms.arn# key above that was deployedgrantee_principal=data.aws_iam_role.my_role.arn#cross-account role or resource/service role you want to grant tooperations=["Encrypt","Decrypt","GenerateDataKey"]}        }

Requirements

Providers

Modules

Resources

Inputs

Outputs

Contributing

License

Coalfire Pages

Copyright