eligibility-signposting-api/infrastructure/stacks/api-layer/kinesis_data_stream.tf at c07dd857223fa8226281ddcbef472af9eea00a89 · NHSDigital/eligibility-signposting-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
resource "aws_kms_key" "kinesis_data_stream_kms_key" {
  description             = "${terraform.workspace == "default" ? "" : "${terraform.workspace}-"} kinesis_data_stream_kms Master Key"
  deletion_window_in_days = 14
  is_enabled              = true
  enable_key_rotation     = true
}

resource "aws_kms_alias" "kinesis_data_stream_kms_key" {
  name          = "alias/${var.project_name}-${var.environment}-kinesis-audit-stream"
  target_key_id = aws_kms_key.kinesis_data_stream_kms_key.key_id
}


data "aws_iam_policy_document" "kinesis_stream_kms_key_policy" {
  #checkov:skip=CKV_AWS_111 Root user needs full KMS key management
  #checkov:skip=CKV_AWS_109 Root user needs full KMS key management
  #checkov:skip=CKV_AWS_356 Root user needs full KMS key management
  statement {
    sid    = "EnableRootPermissions"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }

    actions   = ["kms:*"]
    resources = ["*"]
  }

  statement {
    sid    = "AllowLambdaUseOfKey"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.eligibility_lambda_role.arn]
    }

    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "AllowFirehoseRoleUseOfKey"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.eligibility_audit_firehose_role.arn]
    }

    actions = [
      "kms:Decrypt",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]

    resources = ["*"]
  }
}

resource "aws_kms_key_policy" "kinesis_stream_kms_key_policy" {
  key_id = aws_kms_key.kinesis_data_stream_kms_key.id
  policy = data.aws_iam_policy_document.kinesis_stream_kms_key_policy.json
}

resource "aws_kinesis_stream" "kinesis_source_stream" {
  name             = "${var.project_name}-${var.environment}-kinesis-audit-stream"
  retention_period = 24

  stream_mode_details {
    stream_mode = "ON_DEMAND" # can discuss later
  }

  encryption_type = "KMS"
  kms_key_id      = aws_kms_key.kinesis_data_stream_kms_key.arn
}