lambda-kms module

[miguelgrinberg]

No description provided.

[ryandub]

Sorry it took me a while to get to this. Thanks for the PR - can you take a look at the comments and make some small changes?

[ryandub]

The template_file data resource for IAM policies is an older way of doing this. Can you switch this to use the newer iam_policy_document data resource? There are a few examples in this repo of how to use it such as this one.

[ryandub]

I think it might be worthwhile to allow root and the deployment user access to kms:*, but also add a deny on decrypt (and possibly any other sensitive functions). This will allow the user to administer the key for deployment purposes, but not open up encrypted data to a wider audience than necessary.

[miguelgrinberg]

Decrypt is needed for fleece config.

[miguelgrinberg]

@ryandub per our discussion, I added a admin_can_decrypt variable. Here is the example invocation of this module that I'm using:

module "helloworld_key" {
  source      = "github.com/miguelgrinberg/xplat-terraform-modules?ref=lambda-kms-module//modules/lambda-kms"

  lambda_role = "${module.helloworld_lambda_authorizer.lambda_role_name}"
  key_alias   = "${var.stage}-${var.service_name}-config-key"
  key_autorotate = "true"
  admin_can_decrypt = "true"
}