Merge pull request #6 from vistaprint/fix/rotate-kms-key

Fix KMS key issues
vistaprint · Sep 28, 2021 · cb9927c · cb9927c
2 parents 5344064 + 506821f
commit cb9927c
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 63 deletions.
diff --git a/kms-key.tf b/kms-key.tf
@@ -1,71 +1,60 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_kms_key" "ebs_encryption_key" {
+  count = var.encrypt_ebs ? 1 : 0
+
   description             = "Encryption Key for EBS volumes"
   deletion_window_in_days = 7
+  enable_key_rotation     = true
 
   policy = jsonencode({
-    "Version": "2012-10-17",
-    "Id": "auto-ebs-2",
-    "Statement": [
-        {
-            "Sid": "Allow access through EBS for all principals in the account that are authorized to use EBS",
-            "Effect": "Allow",
-            "Principal": {
-                "AWS": "*"
-            },
-            "Action": [
-                "kms:Encrypt",
-                "kms:Decrypt",
-                "kms:ReEncrypt*",
-                "kms:GenerateDataKey*",
-                "kms:CreateGrant",
-                "kms:DescribeKey"
-            ],
-            "Resource": "*",
-            "Condition": {
-                "StringEquals": {
-                    "kms:CallerAccount": data.aws_caller_identity.current.account_id,
-                    "kms:ViaService": "ec2.eu-west-1.amazonaws.com"
-                }
-            }
+    "Version" : "2012-10-17",
+    "Id" : "auto-ebs-2",
+    "Statement" : [
+      {
+        "Sid" : "Allow access through EBS for all principals in the account that are authorized to use EBS",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "*"
         },
-        {
-                  "Sid": "Allow administration of the key",
-                  "Effect": "Allow",
-                  "Principal": {
-                    "AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
-                  },
-                  "Action": [
-                      "kms:Create*",
-                      "kms:Describe*",
-                      "kms:Enable*",
-                      "kms:List*",
-                      "kms:Put*",
-                      "kms:Update*",
-                      "kms:Revoke*",
-                      "kms:Disable*",
-                      "kms:Get*",
-                      "kms:Delete*",
-                      "kms:ScheduleKeyDeletion",
-                      "kms:CancelKeyDeletion"
-                  ],
-                  "Resource": "*"
-              },
-        {
-            "Sid": "Allow direct access to key metadata to the account",
-            "Effect": "Allow",
-            "Principal": {
-                "AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
-            },
-            "Action": [
-                "kms:Describe*",
-                "kms:Get*",
-                "kms:List*",
-                "kms:RevokeGrant"
-            ],
-            "Resource": "*"
+        "Action" : [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:CreateGrant",
+          "kms:DescribeKey"
+        ],
+        "Resource" : "*",
+        "Condition" : {
+          "StringEquals" : {
+            "kms:CallerAccount" : data.aws_caller_identity.current.account_id,
+            "kms:ViaService" : "ec2.${var.region}.amazonaws.com"
+          }
         }
+      },
+      {
+        "Sid" : "Allow administration of the key",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
+        },
+        "Action" : [
+          "kms:Create*",
+          "kms:Describe*",
+          "kms:Enable*",
+          "kms:List*",
+          "kms:Put*",
+          "kms:Update*",
+          "kms:Revoke*",
+          "kms:Disable*",
+          "kms:Get*",
+          "kms:Delete*",
+          "kms:ScheduleKeyDeletion",
+          "kms:CancelKeyDeletion"
+        ],
+        "Resource" : "*"
+      }
     ]
   })
 }
diff --git a/launch-template.tf b/launch-template.tf
@@ -24,7 +24,7 @@ resource "aws_launch_template" "worker_nodes" {
       volume_type           = var.volume_type
       delete_on_termination = true
       encrypted             = var.encrypt_ebs
-      kms_key_id            = var.encrypt_ebs ? aws_kms_key.ebs_encryption_key.arn : null
+      kms_key_id            = var.encrypt_ebs ? aws_kms_key.ebs_encryption_key[0].arn : null
     }
   }
 

diff --git a/versions.tf b/versions.tf
@@ -1,12 +1,12 @@
 terraform {
   required_providers {
     helm = {
-      source = "hashicorp/helm"
+      source  = "hashicorp/helm"
       version = "~> 2.0"
     }
     kubernetes = {
-      source = "hashicorp/kubernetes"
+      source  = "hashicorp/kubernetes"
       version = "~> 1.13"
-    }    
+    }
   }
 }