Add KMS re-encrypt policies that (may) be blocking start of new EMR c…

…lusters
statgen · Feb 26, 2024 · abb2dd1 · abb2dd1
1 parent 9536662
commit abb2dd1
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/imputation-server/main.tf b/modules/imputation-server/main.tf
@@ -57,13 +57,13 @@ resource "aws_kms_alias" "emr_kms" {
 resource "aws_kms_grant" "ec2_kms_grant" {
   key_id            = aws_kms_key.emr_kms.arn
   grantee_principal = var.ec2_role_arn
-  operations        = ["Encrypt", "Decrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext"]
+  operations        = ["Encrypt", "Decrypt", "ReEncryptFrom", "ReEncryptTo", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext"]
 }
 
 resource "aws_kms_grant" "emr_kms_grant" {
   key_id            = aws_kms_key.emr_kms.arn
   grantee_principal = var.emr_role_arn
-  operations        = ["Encrypt", "Decrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "CreateGrant", "RetireGrant"]
+  operations        = ["Encrypt", "Decrypt", "ReEncryptFrom", "ReEncryptTo", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "CreateGrant", "RetireGrant"]
 }
 
 # ---------------------------------------------------------------------------------------------------------------------