eligibility-signposting-api/infrastructure/stacks/api-layer/ssm.tf at ef6216891c0b4f81128a51a5bb0b1facbd889068 · NHSDigital/eligibility-signposting-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
resource "aws_kms_key" "splunk_hec_kms" {
  description             = "KMS key for encrypting Splunk HEC SSM parameters"
  deletion_window_in_days = 7
  enable_key_rotation     = true
  tags = {
    Name        = "splunk-hec-ssm-kms-key"
    Environment = var.environment
    Stack       = local.stack_name
    Purpose     = "Splunk HEC SSM encryption"
    ManagedBy   = "terraform"
  }
}

resource "aws_kms_key_policy" "splunk_hec_kms_policy" {
  key_id = aws_kms_key.splunk_hec_kms.id
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Sid       = "AllowRootAccountFullAccess"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Sid       = "AllowSSMServiceUseOfKey"
        Effect    = "Allow"
        Principal = { Service = "ssm.amazonaws.com" }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      },
      {
        Sid       = "AllowFirehoseServiceUseOfKey"
        Effect    = "Allow"
        Principal = { Service = "firehose.amazonaws.com" }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      },
    ]
  })
}

resource "aws_ssm_parameter" "splunk_hec_token" {
  name        = "/splunk/hec/token"
  description = "Splunk HEC token"
  type        = "SecureString"
  key_id      = aws_kms_key.splunk_hec_kms.id # Will migrate to customer key after initial creation
  value       = var.SPLUNK_HEC_TOKEN
  tier        = "Advanced"

  tags = {
    Environment = var.environment
    Stack       = local.stack_name
    Purpose     = "Splunk HEC token"
    ManagedBy   = "terraform"
  }

  lifecycle {
    ignore_changes = [value] # Needs manual changes in future
  }
}

resource "aws_ssm_parameter" "splunk_hec_endpoint" {
  name        = "/splunk/hec/endpoint"
  description = "Splunk HEC endpoint"
  type        = "SecureString"
  key_id      = aws_kms_key.splunk_hec_kms.id
  value       = var.SPLUNK_HEC_ENDPOINT
  tier        = "Advanced"

  tags = {
    Environment = var.environment
    Stack       = local.stack_name
    Purpose     = "Splunk HEC endpoint"
    ManagedBy   = "terraform"
  }

  lifecycle {
    ignore_changes = [value]
  }
}