Skip to content

Commit 19a64c8

Browse files
monhaquemonhaque
authored
Merge pull request #6407 from govuk-one-login/AUT-4213-update-dynamodb-table-kms-key-policy
AUT-4213: Auth AWS account permission on KMS key
2 parents 938c3c3 + 2f507c0 commit 19a64c8

File tree

1 file changed

+129
-156
lines changed

1 file changed

+129
-156
lines changed

‎ci/terraform/shared/kms.tf

Lines changed: 129 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -473,21 +473,12 @@ resource "aws_kms_key" "auth_code_store_signing_key" {
473473
key_usage = "ENCRYPT_DECRYPT"
474474
customer_master_key_spec = "SYMMETRIC_DEFAULT"
475475
enable_key_rotation = true
476-
policy = jsonencode({
477-
Version = "2012-10-17"
478-
Id = "key-policy-dynamodb",
479-
Statement = [
480-
{
481-
Sid = "Allow IAM to manage this key",
482-
Effect = "Allow",
483-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
484-
Action = [
485-
"kms:*"
486-
],
487-
Resource = "*"
488-
}
489-
]
490-
})
476+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
477+
}
478+
479+
resource "aws_kms_alias" "auth_code_store_signing_key_alias" {
480+
name = "alias/${var.environment}-auth-code-store-table-encryption-key"
481+
target_key_id = aws_kms_key.auth_code_store_signing_key.key_id
491482
}
492483

493484
# Authorization Token endpoint Signing KMS key
@@ -510,21 +501,12 @@ resource "aws_kms_key" "access_token_store_signing_key" {
510501
key_usage = "ENCRYPT_DECRYPT"
511502
customer_master_key_spec = "SYMMETRIC_DEFAULT"
512503
enable_key_rotation = true
513-
policy = jsonencode({
514-
Version = "2012-10-17"
515-
Id = "key-policy-dynamodb",
516-
Statement = [
517-
{
518-
Sid = "Allow IAM to manage this key",
519-
Effect = "Allow",
520-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
521-
Action = [
522-
"kms:*"
523-
],
524-
Resource = "*"
525-
}
526-
]
527-
})
504+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
505+
}
506+
507+
resource "aws_kms_alias" "access_token_store_signing_key_alias" {
508+
name = "alias/${var.environment}-access-token-store-table-encryption-key"
509+
target_key_id = aws_kms_key.access_token_store_signing_key.key_id
528510
}
529511

530512
resource "aws_kms_key" "bulk_email_users_encryption_key" {
@@ -533,21 +515,12 @@ resource "aws_kms_key" "bulk_email_users_encryption_key" {
533515
key_usage = "ENCRYPT_DECRYPT"
534516
customer_master_key_spec = "SYMMETRIC_DEFAULT"
535517
enable_key_rotation = true
536-
policy = jsonencode({
537-
Version = "2012-10-17"
538-
Id = "key-policy-dynamodb",
539-
Statement = [
540-
{
541-
Sid = "Allow IAM to manage this key",
542-
Effect = "Allow",
543-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
544-
Action = [
545-
"kms:*"
546-
],
547-
Resource = "*"
548-
}
549-
]
550-
})
518+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
519+
}
520+
521+
resource "aws_kms_alias" "bulk_email_users_encryption_key_alias" {
522+
name = "alias/${var.environment}-bulk-email-users-table-encryption-key"
523+
target_key_id = aws_kms_key.bulk_email_users_encryption_key.key_id
551524
}
552525

553526
resource "aws_kms_key" "account_modifiers_table_encryption_key" {
@@ -556,21 +529,12 @@ resource "aws_kms_key" "account_modifiers_table_encryption_key" {
556529
key_usage = "ENCRYPT_DECRYPT"
557530
customer_master_key_spec = "SYMMETRIC_DEFAULT"
558531
enable_key_rotation = true
559-
policy = jsonencode({
560-
Version = "2012-10-17"
561-
Id = "key-policy-dynamodb",
562-
Statement = [
563-
{
564-
Sid = "Allow IAM to manage this key",
565-
Effect = "Allow",
566-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
567-
Action = [
568-
"kms:*"
569-
],
570-
Resource = "*"
571-
}
572-
]
573-
})
532+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
533+
}
534+
535+
resource "aws_kms_alias" "account_modifiers_table_encryption_key_alias" {
536+
name = "alias/${var.environment}-account-modifiers-table-encryption-key"
537+
target_key_id = aws_kms_key.account_modifiers_table_encryption_key.key_id
574538
}
575539

576540
resource "aws_kms_key" "user_credentials_table_encryption_key" {
@@ -579,21 +543,12 @@ resource "aws_kms_key" "user_credentials_table_encryption_key" {
579543
key_usage = "ENCRYPT_DECRYPT"
580544
customer_master_key_spec = "SYMMETRIC_DEFAULT"
581545
enable_key_rotation = true
582-
policy = jsonencode({
583-
Version = "2012-10-17"
584-
Id = "key-policy-dynamodb",
585-
Statement = [
586-
{
587-
Sid = "Allow IAM to manage this key",
588-
Effect = "Allow",
589-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
590-
Action = [
591-
"kms:*"
592-
],
593-
Resource = "*"
594-
}
595-
]
596-
})
546+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
547+
}
548+
549+
resource "aws_kms_alias" "user_credentials_table_encryption_key_alias" {
550+
name = "alias/${var.environment}-user-credentials-table-encryption-key"
551+
target_key_id = aws_kms_key.user_credentials_table_encryption_key.key_id
597552
}
598553

599554
resource "aws_kms_key" "common_passwords_table_encryption_key" {
@@ -602,21 +557,12 @@ resource "aws_kms_key" "common_passwords_table_encryption_key" {
602557
key_usage = "ENCRYPT_DECRYPT"
603558
customer_master_key_spec = "SYMMETRIC_DEFAULT"
604559
enable_key_rotation = true
605-
policy = jsonencode({
606-
Version = "2012-10-17"
607-
Id = "key-policy-dynamodb",
608-
Statement = [
609-
{
610-
Sid = "Allow IAM to manage this key",
611-
Effect = "Allow",
612-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
613-
Action = [
614-
"kms:*"
615-
],
616-
Resource = "*"
617-
}
618-
]
619-
})
560+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
561+
}
562+
563+
resource "aws_kms_alias" "common_passwords_table_encryption_key_alias" {
564+
name = "alias/${var.environment}-common-passwords-table-encryption-key"
565+
target_key_id = aws_kms_key.common_passwords_table_encryption_key.key_id
620566
}
621567

622568
resource "aws_kms_key" "doc_app_credential_table_encryption_key" {
@@ -628,6 +574,11 @@ resource "aws_kms_key" "doc_app_credential_table_encryption_key" {
628574
policy = data.aws_iam_policy_document.cross_account_doc_app_credential_table_encryption_key_policy.json
629575
}
630576

577+
resource "aws_kms_alias" "doc_app_credential_table_encryption_key_alias" {
578+
name = "alias/${var.environment}-doc-app-credential-table-encryption-key"
579+
target_key_id = aws_kms_key.doc_app_credential_table_encryption_key.key_id
580+
}
581+
631582
data "aws_iam_policy_document" "cross_account_doc_app_credential_table_encryption_key_policy" {
632583
statement {
633584
sid = "DefaultAccessPolicy"
@@ -726,6 +677,34 @@ data "aws_iam_policy_document" "cross_account_table_encryption_key_access_policy
726677
identifiers = [var.orchestration_account_id]
727678
}
728679
}
680+
681+
dynamic "statement" {
682+
for_each = var.environment != "production" && var.environment != "integration" && var.environment != "staging" ? ["1"] : []
683+
content {
684+
sid = "Allow Auth access to dynamo table encryption key"
685+
effect = "Allow"
686+
687+
actions = [
688+
"kms:Encrypt",
689+
"kms:Decrypt",
690+
"kms:ReEncrypt*",
691+
"kms:GenerateDataKey*",
692+
"kms:CreateGrant",
693+
"kms:DescribeKey",
694+
]
695+
principals {
696+
type = "AWS"
697+
identifiers = [
698+
format(
699+
"arn:%s:iam::%s:root",
700+
data.aws_partition.current.partition,
701+
var.auth_new_account_id
702+
)
703+
]
704+
}
705+
resources = ["*"]
706+
}
707+
}
729708
}
730709

731710
resource "aws_kms_key" "user_profile_table_encryption_key" {
@@ -750,21 +729,12 @@ resource "aws_kms_key" "email_check_result_encryption_key" {
750729
key_usage = "ENCRYPT_DECRYPT"
751730
customer_master_key_spec = "SYMMETRIC_DEFAULT"
752731
enable_key_rotation = true
753-
policy = jsonencode({
754-
Version = "2012-10-17"
755-
Id = "key-policy-dynamodb",
756-
Statement = [
757-
{
758-
Sid = "Allow IAM to manage this key",
759-
Effect = "Allow",
760-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
761-
Action = [
762-
"kms:*"
763-
],
764-
Resource = "*"
765-
}
766-
]
767-
})
732+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
733+
}
734+
735+
resource "aws_kms_alias" "email_check_result_encryption_key_alias" {
736+
name = "alias/${var.environment}-email-check-result-table-encryption-key"
737+
target_key_id = aws_kms_key.email_check_result_encryption_key.key_id
768738
}
769739

770740
resource "aws_kms_key" "pending_email_check_queue_encryption_key" {
@@ -803,23 +773,7 @@ resource "aws_kms_key" "authentication_attempt_encryption_key" {
803773
key_usage = "ENCRYPT_DECRYPT"
804774
customer_master_key_spec = "SYMMETRIC_DEFAULT"
805775
enable_key_rotation = true
806-
807-
policy = jsonencode({
808-
Version = "2012-10-17"
809-
Id = "key-policy-dynamodb",
810-
Statement = [
811-
{
812-
Sid = "Allow IAM to manage this key",
813-
Effect = "Allow",
814-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
815-
Action = [
816-
"kms:*"
817-
],
818-
Resource = "*"
819-
}
820-
]
821-
})
822-
776+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
823777
}
824778

825779
resource "aws_kms_alias" "authentication_attempt_encryption_key_alias" {
@@ -833,23 +787,7 @@ resource "aws_kms_key" "auth_session_table_encryption_key" {
833787
key_usage = "ENCRYPT_DECRYPT"
834788
customer_master_key_spec = "SYMMETRIC_DEFAULT"
835789
enable_key_rotation = true
836-
837-
policy = jsonencode({
838-
Version = "2012-10-17"
839-
Id = "key-policy-dynamodb",
840-
Statement = [
841-
{
842-
Sid = "Allow IAM to manage this key",
843-
Effect = "Allow",
844-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
845-
Action = [
846-
"kms:*"
847-
],
848-
Resource = "*"
849-
}
850-
]
851-
})
852-
790+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
853791
}
854792

855793
resource "aws_kms_alias" "auth_session_table_encryption_key_alias" {
@@ -864,30 +802,65 @@ resource "aws_kms_key" "id_reverification_state_table_encryption_key" {
864802
key_usage = "ENCRYPT_DECRYPT"
865803
customer_master_key_spec = "SYMMETRIC_DEFAULT"
866804
enable_key_rotation = true
867-
868-
policy = jsonencode({
869-
Version = "2012-10-17"
870-
Id = "key-policy-dynamodb",
871-
Statement = [
872-
{
873-
Sid = "Allow IAM to manage this key",
874-
Effect = "Allow",
875-
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
876-
Action = [
877-
"kms:*"
878-
],
879-
Resource = "*"
880-
}
881-
]
882-
})
883-
805+
policy = data.aws_iam_policy_document.auth_dynamo_table_encryption_key_access_policy.json
884806
}
885807

886808
resource "aws_kms_alias" "id_reverification_state_table_encryption_key_alias" {
887809
name = "alias/${var.environment}-id-reverification-state-table-encryption-key"
888810
target_key_id = aws_kms_key.id_reverification_state_table_encryption_key.key_id
889811
}
890812

813+
## KMS Key policy to Allow access to the KMS key for the new authentication AWS account to access DynamoDB table
814+
815+
816+
data "aws_iam_policy_document" "auth_dynamo_table_encryption_key_access_policy" {
817+
#checkov:skip=CKV_AWS_109:Root requires all kms:* actions access
818+
#checkov:skip=CKV_AWS_111:Root requires all kms:* actions access
819+
#checkov:skip=CKV_AWS_356:Policy cannot self-reference the kms key, so resources wildcard is required
820+
statement {
821+
sid = "DefaultAccessPolicy"
822+
effect = "Allow"
823+
824+
actions = [
825+
"kms:*"
826+
]
827+
resources = ["*"]
828+
829+
principals {
830+
type = "AWS"
831+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
832+
}
833+
}
834+
835+
dynamic "statement" {
836+
for_each = var.environment != "production" && var.environment != "integration" && var.environment != "staging" ? ["1"] : []
837+
content {
838+
sid = "Allow Auth access to dynamo table encryption key"
839+
effect = "Allow"
840+
841+
actions = [
842+
"kms:Encrypt",
843+
"kms:Decrypt",
844+
"kms:ReEncrypt*",
845+
"kms:GenerateDataKey*",
846+
"kms:CreateGrant",
847+
"kms:DescribeKey",
848+
]
849+
principals {
850+
type = "AWS"
851+
identifiers = [
852+
format(
853+
"arn:%s:iam::%s:root",
854+
data.aws_partition.current.partition,
855+
var.auth_new_account_id
856+
)
857+
]
858+
}
859+
resources = ["*"]
860+
}
861+
}
862+
}
863+
891864
## Frontend KMS key for signing JWT tokens
892865
resource "aws_kms_key" "authentication_encryption_key" {
893866
description = "KMS encryption key for decrypting requests from Orchestration"

0 commit comments

Comments
 (0)