-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
added support for Amazon MWAA, Amazon ECR and Amazon EKS
- Loading branch information
1 parent
ceee0d1
commit 5e36e26
Showing
12 changed files
with
275 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_kms_ecr" { | ||
| description = "Enable customer managed key that can be used to encrypt/decrypt Amazon ECR" | ||
| type = bool | ||
| default = false | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_key_rotation_ecr" { | ||
| description = "Enable key rotation for Amazon ECR CMK" | ||
| type = bool | ||
| default = true | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_multi_region_ecr" { | ||
| description = "Enable multi-region for Amazon ECR CMK" | ||
| type = bool | ||
| default = false | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "override_policy_ecr" { | ||
| description = "A valid KMS key policy JSON document. If not specified, a canonical key policy will be used." | ||
| type = string | ||
| default = null | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "ecr" { | ||
| # checkov:skip=CKV_AWS_109: Not applicable, using condition | ||
| # checkov:skip=CKV_AWS_111: Not applicable, using condition | ||
| source_policy_documents = [data.aws_iam_policy_document.admin_kms_policy.json] | ||
|
|
||
| statement { | ||
| sid = "Allow access through Amazon ECR for all principals in the account that are authorized to use Amazon ECR" | ||
| principals { | ||
| type = "AWS" | ||
| identifiers = ["*"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey", | ||
| "kms:CreateGrant", | ||
| "kms:RetireGrant" | ||
| ] | ||
| resources = ["*"] | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:ViaService" | ||
| values = [ | ||
| "ecr.${var.region}.amazonaws.com" | ||
| ] | ||
| } | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:CallerAccount" | ||
| values = local.allowed_accounts_via_service | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_kms_eks" { | ||
| description = "Enable customer managed key that can be used to encrypt/decrypt Amazon EKS" | ||
| type = bool | ||
| default = false | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_key_rotation_eks" { | ||
| description = "Enable key rotation for Amazon EKS CMK" | ||
| type = bool | ||
| default = true | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "enable_multi_region_eks" { | ||
| description = "Enable multi-region for Amazon EKS CMK" | ||
| type = bool | ||
| default = false | ||
| } | ||
|
|
||
| # tflint-ignore: terraform_standard_module_structure | ||
| variable "override_policy_eks" { | ||
| description = "A valid KMS key policy JSON document. If not specified, a canonical key policy will be used." | ||
| type = string | ||
| default = null | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "eks" { | ||
| # checkov:skip=CKV_AWS_109: Not applicable, using condition | ||
| # checkov:skip=CKV_AWS_111: Not applicable, using condition | ||
| source_policy_documents = [data.aws_iam_policy_document.admin_kms_policy.json] | ||
|
|
||
| statement { | ||
| sid = "Allow access through Amazon EKS for all principals in the account that are authorized to use Amazon EKS" | ||
| principals { | ||
| type = "AWS" | ||
| identifiers = ["*"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey" | ||
| ] | ||
| resources = ["*"] | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:ViaService" | ||
| values = [ | ||
| "eks.${var.region}.amazonaws.com" | ||
| ] | ||
| } | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:CallerAccount" | ||
| values = local.allowed_accounts_via_service | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.