allow permissions on kms key

ministryofjustice · Jan 7, 2025 · e6fe538 · e6fe538
1 parent 8fad946
commit e6fe538
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 7 deletions.
diff --git a/terraform/account/kms.tf b/terraform/account/kms.tf
@@ -29,6 +29,7 @@ module "event_receiver_mrk" {
 
   key_description         = "KMS key for received events"
   key_alias               = "${local.environment}-event-receiver-mrk"
+  key_policy              = data.aws_iam_policy_document.event_receiver_kms.json
   deletion_window_in_days = 7
 
   providers = {
@@ -146,3 +147,48 @@ data "aws_iam_policy_document" "cloudwatch_kms" {
     }
   }
 }
+
+data "aws_iam_policy_document" "event_receiver_kms" {
+  statement {
+    sid    = "Allow Encryption by Service"
+    effect = "Allow"
+    resources = [
+      "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
+    ]
+    actions = [
+      "kms:Encrypt",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:DescribeKey",
+    ]
+
+    principals {
+      type = "Service"
+      identifiers = [
+        "events.amazonaws.com",
+      ]
+    }
+  }
+
+  statement {
+    sid    = "Allow Decryption by Service"
+    effect = "Allow"
+    resources = [
+      "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
+    ]
+    actions = [
+      "kms:Decrypt",
+      "kms:GenerateDataKey*",
+      "kms:DescribeKey",
+    ]
+
+    principals {
+      type = "Service"
+      identifiers = [
+        "sqs.amazonaws.com",
+        "events.amazonaws.com",
+        "lambda.amazonaws.com",
+      ]
+    }
+  }
+}
diff --git a/terraform/environment/region/modules/event_bus/kms.tf b/terraform/environment/region/modules/event_bus/kms.tf
@@ -0,0 +1,4 @@
+data "aws_kms_alias" "event_receiver_mrk" {
+  name     = "alias/${var.environment_name}-event-receiver-mrk"
+  provider = aws.region
+}
diff --git a/terraform/environment/region/modules/event_bus/sqs.tf b/terraform/environment/region/modules/event_bus/sqs.tf
@@ -1,12 +1,7 @@
-data "aws_kms_alias" "sqs" {
-  name     = "alias/sqs-mrk"
-  provider = aws.region
-}
-
 resource "aws_sqs_queue" "receive_events_queue" {
   count                             = var.event_bus_enabled ? 1 : 0
   name                              = "${var.environment_name}-receive-events-queue"
-  kms_master_key_id                 = data.aws_kms_alias.sqs.target_key_id
+  kms_master_key_id                 = data.aws_kms_alias.event_receiver_mrk.target_key_id
   kms_data_key_reuse_period_seconds = 300
 
   visibility_timeout_seconds = var.queue_visibility_timeout
@@ -30,7 +25,7 @@ resource "aws_sqs_queue_policy" "receive_events_queue_policy" {
 resource "aws_sqs_queue" "receive_events_deadletter" {
   count                             = var.event_bus_enabled ? 1 : 0
   name                              = "${var.environment_name}-receive-events-deadletter"
-  kms_master_key_id                 = data.aws_kms_alias.sqs.target_key_id
+  kms_master_key_id                 = data.aws_kms_alias.event_receiver_mrk.target_key_id
   kms_data_key_reuse_period_seconds = 300
   provider                          = aws.region
 }