(None) fix KMS permission to allow kms:CreateGrant

SSHcom · May 27, 2020 · 6d6d00e · 6d6d00e
1 parent 8b19069
commit 6d6d00e
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 3 deletions.
diff --git a/lib/kms.ts b/lib/kms.ts
@@ -111,6 +111,7 @@ export class SymmetricKey extends kms.Key {
             "kms:Encrypt",
             "kms:GenerateDataKey*",
             "kms:ReEncrypt*",
+            "kms:CreateGrant",
           ],
           resources: [this.keyArn],
         }),

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@ssh.com/c3",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Compliant Cloud Components",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

diff --git a/test/kms.test.ts b/test/kms.test.ts
@@ -126,7 +126,8 @@ it('symmetric kms.Key defines an policy',
               "kms:DescribeKey",
               "kms:Encrypt",
               "kms:GenerateDataKey*",
-              "kms:ReEncrypt*"
+              "kms:ReEncrypt*",
+              "kms:CreateGrant",
             ],
             Effect: "Allow",
             Resource: { "Fn::GetAtt": ["MyKey6AB29FA6", "Arn"] }