Commitdfacc47

authored

Merge pull request#81 from ScaleSec/kms

2 parents521ac29 +8db4a22 commitdfacc47Copy full SHA for dfacc47

File tree

+38

-0

lines changed

+38

-0

lines changed

Lines changed: 33 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,33 @@`
	`1`	`+#-----security_controls_scp/modules/kms/deny_kms_custom_key_store.tf----#`
	`2`	`+`
	`3`	`+data"aws_iam_policy_document""deny_kms_custom_key_store" {`
	`4`	`+statement {`
	`5`	`+sid="DenyKmsCustomKeyStore"`
	`6`	`+`
	`7`	`+actions=[`
	`8`	`+"kms:CreateCustomKeyStore",`
	`9`	`+"kms:UpdateCustomKeyStore",`
	`10`	`+"kms:ConnectCustomKeyStore",`
	`11`	`+"kms:DisconnectCustomKeyStore",`
	`12`	`+"kms:DeleteCustomKeyStore",`
	`13`	`+ ]`
	`14`	`+`
	`15`	`+resources=[`
	`16`	`+"*",`
	`17`	`+ ]`
	`18`	`+`
	`19`	`+effect="Deny"`
	`20`	`+ }`
	`21`	`+}`
	`22`	`+`
	`23`	`+resource"aws_organizations_policy""deny_kms_custom_key_store" {`
	`24`	`+name="Deny KMS custom key store"`
	`25`	`+description="Deny the ability to use KMS custom key store`
	`26`	`+`
	`27`	`+ content = data.aws_iam_policy_document.deny_kms_custom_key_store.json`
	`28`	`+}`
	`29`	`+`
	`30`	`+resource"aws_organizations_policy_attachment""deny_kms_custom_key_store_attachment" {`
	`31`	`+ policy_id = aws_organizations_policy.deny_kms_custom_key_store.id`
	`32`	`+ target_id = var.target_id`
	`33`	`+}`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,5 @@`
	`1`	`+#-----security_controls_scp/modules/kms/variables.tf----#`
	`2`	`+variable"target_id" {`
	`3`	`+description="The Root ID, Organizational Unit ID, or AWS Account ID to apply SCPs."`
	`4`	`+type=string`
	`5`	`+}`

Comments

(0)