ELI-704: add depends_on for CloudTrail KMS key policy before log grou… (#622)

* ELI-704: add depends_on for CloudTrail KMS key policy before log group creation

* updated duplicated in-line policy

Author: oneeb-nhs

infrastructure/stacks/api-layer/cloudtrail.tf

@@ -27,34 +27,6 @@ resource "aws_kms_key" "cloudtrail_kms_key" {
   deletion_window_in_days = 14
   enable_key_rotation     = true
 
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "EnableRootPermissions"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
-        }
-        Action   = "kms:*"
-        Resource = "*"
-      },
-      {
-        Sid    = "AllowCloudTrailEncryptLogs"
-        Effect = "Allow"
-        Principal = {
-          Service = "cloudtrail.amazonaws.com"
-        }
-        Action = [
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey",
-          "kms:Encrypt"
-        ]
-        Resource = "*"
-      }
-    ]
-  })
-
   tags = {
     environment  = var.environment
     project_name = var.project_name

infrastructure/stacks/api-layer/cloudwatch.tf

@@ -46,4 +46,6 @@ resource "aws_cloudwatch_log_group" "cloudtrail_log_group" {
   name              = "${terraform.workspace == "default" ? "" : "${terraform.workspace}-"}elid-aws-cloudtrail-logs"
   retention_in_days = 365
   kms_key_id        = aws_kms_alias.cloudtrail_kms_alias.arn
+
+  depends_on = [aws_kms_key_policy.cloudtrail_kms_key_policy]
 }