feat: Using a custom KMS CMK about terraform-aws-cloudtrail HOT 7 CLOSED

Hi @anouarchattouna, thanks for raising this. I've opened a ticket on our JIRA board to address this.
https://lacework.atlassian.net/browse/ALLY-951

from terraform-aws-cloudtrail.

Hi, thanks.
Is your Jira bord accessible publically?

from terraform-aws-cloudtrail.

It's not public, I've added the JIRA link only for internal purposes. We'll put any updates on the ticket here in the issue comments.

from terraform-aws-cloudtrail.

We're seeing the same issue and it poses a hard block on our development as we attempt to upgrade our AWS Terraform provider to ~> 4.9.

module "aws_cloudtrail" {
  source  = "lacework/cloudtrail/aws"
  version = "~> 2.0"

  use_existing_cloudtrail   = true
  bucket_arn                = "arn:aws:s3:::cloudtrail-${var.account_name}"
  bucket_name               = "cloudtrail-${var.account_name}"
  bucket_sse_algorithm      = "aws:kms"
  bucket_sse_key_arn        = module.cloudtrail.cloudtrail_kms_arn
  lacework_integration_name = "${var.account_name}-ct"

  sns_topic_encryption_enabled = false
  sqs_encryption_enabled       = false

  use_existing_sns_topic = true
  sns_topic_arn          = aws_sns_topic.lacework_cloudtrail.arn

  # An existing LACEWORK IAM role! Created by the `lacework_aws_config` module
  use_existing_iam_role = true
  iam_role_name         = module.lacework_aws_config.iam_role_name
  iam_role_arn          = module.lacework_aws_config.iam_role_arn
  iam_role_external_id  = module.lacework_aws_config.external_id
}

Using the above code snippet we get the exact same error as shared in the issue. To be clear, we're upgrading from a working existing version ~> 0.2 to ~> 2.0 which fails. Here is our diff:

 module "aws_cloudtrail" {
   source  = "lacework/cloudtrail/aws"
-  version = "~> 0.2"
+  version = "~> 2.0"

   use_existing_cloudtrail   = true
   bucket_arn                = "arn:aws:s3:::cloudtrail-${var.account_name}"
   bucket_name               = "cloudtrail-${var.account_name}"
-  bucket_enable_encryption  = true
   bucket_sse_algorithm      = "aws:kms"
   bucket_sse_key_arn        = module.cloudtrail.cloudtrail_kms_arn
   lacework_integration_name = "${var.account_name}-ct"

+  sns_topic_encryption_enabled = false
+  sqs_encryption_enabled       = false
+
   use_existing_sns_topic = true
   sns_topic_arn          = aws_sns_topic.lacework_cloudtrail.arn

Here is the error we are receiving:

Invalid count argument

on .terraform/modules/account-bootstrap.aws_cloudtrail/main.tf line 36, in resource "aws_kms_key" "lacework_kms_key":
36:   count                   = local.create_kms_key

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be
created. To work around this, use the -target argument to first apply only
the resources that the count depends on.

from terraform-aws-cloudtrail.

@dmurray-lacework is this ever coming? It was requested 8 months ago. I want to reuse the same KMS key I am already using for cloudtrail, S3, and SNS encryption and SQS.

from terraform-aws-cloudtrail.

Hi @et304383 @anouarchattouna

As we start a new year I am sweeping all our open-sourced repositories and I found out we seem to have forgotten about y'all, I sincerely apologize for the insane delay on responding. I will be keeping an eye on this.

May I ask you to confirm that this PR implements this feature request? #102

from terraform-aws-cloudtrail.

Closing; both changes mentioned here have been addressed.
#84 - released in v2.1.1
#102 - To be released in v2.5.0

from terraform-aws-cloudtrail.