UML3738: remove lambda on kms (#3046)

ministryofjustice · Jan 9, 2025 · 6d24394 · 6d24394
1 parent 4b9201f
commit 6d24394
Showing 1 changed file with 8 additions and 28 deletions.
diff --git a/terraform/account/kms.tf b/terraform/account/kms.tf
@@ -163,11 +163,9 @@ module "event_receiver_mrk" {
 
 data "aws_iam_policy_document" "event_receiver_kms" {
   statement {
-    sid    = "Allow Encryption by Service"
-    effect = "Allow"
-    resources = [
-      "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
-    ]
+    sid       = "Allow Encryption by Service"
+    effect    = "Allow"
+    resources = ["*"]
     actions = [
       "kms:Encrypt",
       "kms:ReEncrypt*",
@@ -184,40 +182,22 @@ data "aws_iam_policy_document" "event_receiver_kms" {
   }
 
   statement {
-    sid    = "Allow Decryption by Service"
-    effect = "Allow"
-    resources = [
-      "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
-    ]
+    sid       = "Allow Decryption by Service"
+    effect    = "Allow"
+    resources = ["*"]
     actions = [
       "kms:Decrypt",
       "kms:GenerateDataKey*",
-      "kms:DescribeKey",
+      "kms:DescribeKey"
     ]
 
     principals {
       type = "Service"
       identifiers = [
         "sqs.amazonaws.com",
-        "events.amazonaws.com",
-      ]
-    }
-  }
-  statement {
-    sid       = "Allow Lambda Decrypt"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "kms:Decrypt",
-      "kms:DescribeKey",
-    ]
-    principals {
-      type = "AWS"
-      identifiers = [
-        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/event-receiver-${local.environment}"
+        "events.amazonaws.com"
       ]
     }
-
   }
 
   statement {