-
Notifications
You must be signed in to change notification settings - Fork 1
/
kms.tf
75 lines (62 loc) · 1.74 KB
/
kms.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
data "aws_iam_policy_document" "kms" {
statement {
resources = ["*"]
actions = ["kms:*"]
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.id}:root"]
}
}
statement {
effect = "Allow"
resources = ["*"]
actions = ["kms:*"]
principals {
type = "Service"
identifiers = ["eks.amazonaws.com"]
}
}
}
resource "aws_kms_key" "cluster" {
description = "KMS CMK used by eks cluster."
enable_key_rotation = true
policy = data.aws_iam_policy_document.kms.json
tags = merge(local.default_tags, {
"Name" = "${local.name_prefix}eks-kms"
})
}
resource "aws_kms_alias" "cluster" {
name = "alias/${local.name_prefix}eks-cluster-kms-cmk"
target_key_id = aws_kms_key.cluster.key_id
}
# Kubernetes Secret KMS Key
data "aws_iam_policy_document" "k8s" {
statement {
resources = ["*"]
not_actions = ["kms:Decrypt"]
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.id}:root"]
}
}
statement {
resources = ["*"]
actions = ["kms:Decrypt"]
principals {
type = "AWS"
identifiers = compact([data.aws_iam_session_context.current.issuer_arn, local.config.administrator_role_arn])
}
}
}
resource "aws_kms_key" "k8s" {
description = "KMS CMK used To create kubernetes secrets"
enable_key_rotation = true
policy = data.aws_iam_policy_document.k8s.json
tags = merge(local.default_tags, {
"Name" = "${local.name_prefix}k8s-secret-kms"
})
}
resource "aws_kms_alias" "k8s" {
name = "alias/${local.name_prefix}k8s-secret-kms"
target_key_id = aws_kms_key.k8s.key_id
}