architect-deploy/aws_secrets.tf at main · agentsofthesystem/architect-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
resource "random_password" "flask_secret_key" {
  length           = 16
  special          = true
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

resource "aws_secretsmanager_secret" "flask_secret_key" {
  name = "aots-flask-app-secret-key"
  kms_key_id = aws_kms_key.app_kms_key.arn

  # Delete immediately if the resource is destroyed
  recovery_window_in_days = 0

  tags = {
    Environment = var.app_environment
    Application = var.app_acronym
  }
}

resource "aws_secretsmanager_secret_version" "flask_secret_key" {
  secret_id     = aws_secretsmanager_secret.flask_secret_key.id
  secret_string = random_password.flask_secret_key.result
}

resource "aws_secretsmanager_secret_rotation" "db_secret_rotation" {
  secret_id           = data.aws_secretsmanager_secret.db_secret.id

  rotate_immediately = false

  rotation_rules {
    automatically_after_days = 1000
  }
}


resource "aws_kms_key" "app_kms_key" {

  description             = "AOTS App Encryption Key"

  deletion_window_in_days = 7

  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "key-default-1"
    Statement = [

      {
        Sid    = "Enable IAM User Permissions"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
        },
        Action   = "kms:*"
        Resource = "*"
      },

      {
        Sid    = "Allow access for Key Administrators"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${var.iam_service_account_user_name}",
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${var.iam_terraform_user_name}"
        },
        Action = [
          "kms:ReplicateKey",
          "kms:Create*",
          "kms:Describe*",
          "kms:Enable*",
          "kms:List*",
          "kms:Put*",
          "kms:Update*",
          "kms:Revoke*",
          "kms:Disable*",
          "kms:Get*",
          "kms:Delete*",
          "kms:ScheduleKeyDeletion",
          "kms:CancelKeyDeletion"
        ],
        Resource = "*"
      },

      {
        Sid    = "Allow use of the key"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${var.iam_terraform_user_name}"
        },
        Action = [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
        ],
        Resource = "*"
      },

    {
        Sid = "Allow attachment of persistent resources",
        Effect = "Allow",
        Principal = {
            AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/${var.iam_terraform_user_name}"
        },
        Action = [
            "kms:CreateGrant",
            "kms:ListGrants",
            "kms:RevokeGrant"
        ],
        Resource = "*",
        Condition = {
            Bool = {
                "kms:GrantIsForAWSResource": "true"
            }
        }
    }
    ]
  })

  tags = {
    Environment = var.app_environment
    Application = var.app_acronym
  }

}