eligibility-signposting-api/infrastructure/modules/api_gateway/kms.tf at 075ebaf6fd6d488fa64dfd733d2572f930cac94e · NHSDigital/eligibility-signposting-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
resource "aws_kms_key" "api_gateway" {
  description             = "${var.workspace} - KMS Key for ${var.api_gateway_name} API Gateway"
  deletion_window_in_days = 14
  enable_key_rotation     = true

  tags = {
    Stack = var.stack_name
  }
}

resource "aws_kms_alias" "api_gateway" {
  name          = "alias/${var.workspace}-${var.api_gateway_name}-cloudwatch-logs"
  target_key_id = aws_kms_key.api_gateway.key_id
}

resource "aws_kms_key_policy" "api_gateway" {
  key_id = aws_kms_key.api_gateway.id
  policy = data.aws_iam_policy_document.api_gateway.json
}

data "aws_iam_policy_document" "api_gateway" {
  statement {
    sid    = "Enable IAM User Permissions for ${var.api_gateway_name} API Gateway"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
    actions = ["kms:*"]
    resources = [aws_kms_key.api_gateway.arn]
  }
  statement {
    sid    = "APIGatewayCloudwatchKMSAccess"
    effect = "Allow"
    principals {
      type = "Service"
      identifiers = ["logs.${var.region}.amazonaws.com"]
    }
    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*",
      "kms:CreateGrant"
    ]
    resources = [aws_kms_key.api_gateway.arn]
    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:logs:arn"
      values = [
        "arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/*"
      ]
    }
  }
}