-
-
Notifications
You must be signed in to change notification settings - Fork 1
/
main.tf
41 lines (39 loc) · 929 Bytes
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
resource "aws_kms_key" "this" {
description = var.description
customer_master_key_spec = "ECC_NIST_P256"
deletion_window_in_days = var.deletion_window_days
key_usage = "SIGN_VERIFY"
policy = jsonencode({
Statement = [
{
Action = [
"kms:DescribeKey",
"kms:GetPublicKey",
"kms:Sign",
],
Effect = "Allow"
Principal = {
Service = "api-service.dnssec.route53.aws.internal"
}
Sid = "Route 53 DNSSEC Permissions"
},
{
Action = "kms:*"
Effect = "Allow"
Principal = {
AWS = "*"
}
Resource = "*"
Sid = "IAM User Permissions"
},
]
Version = "2012-10-17"
})
tags = {
Name = var.name,
}
}
resource "aws_kms_alias" "this" {
name = "alias/${var.name}"
target_key_id = aws_kms_key.this.key_id
}