tedilabs / terraform-aws-secret Goto Github PK
View Code? Open in Web Editor NEW🌳 A sustainable Terraform Package which creates Secret resources on AWS
Home Page: https://registry.terraform.io/modules/tedilabs/secret/aws
License: Apache License 2.0
terraform-aws-secret's People
Contributors
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
Stargazers
Watchers
terraform-aws-secret's Issues
Support `grant` of `kms-key`
New Resource: aws_kms_key_policy
resource/aws_secretsmanager_secret: Add duration and schedule_expression attributes to rotation_rules configuration block
Support easy configuration for `policy` of `kms-key` module like AWS web console
resource/aws_secretsmanager_secret_rotation: Add duration and schedule_expression attributes to rotation_rules configuration block
resource/aws_ssm_parameter: Support aws:ssm:integration as a valid value for data_type
Wrong output during terraform plan
Is there an existing issue for this?
- I have searched the existing issues
Description of the bug
I am using following resource block:
resource "aws_kms_key_policy" "cmk" {
key_id = data.aws_kms_key.by_alias.id
policy = jsonencode({
"Version": "2012-10-17",
"Statement": [
{
"Sid": "SId#1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789:root"
},
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": "123456789",
"kms:GranteePrincipal": "arn:aws:iam::123456789:role/aws-service-role/mgn.amazonaws.com/AWSServiceRoleForApplicationMigrationService"
},
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"CreateGrant",
"DescribeKey",
"Encrypt",
"Decrypt",
"GenerateDataKey",
"GenerateDataKeyWithoutPlaintext"
]
},
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "Sid#2",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789:root",
"arn:aws:iam::123456789:role/aws-service-role/mgn.amazonaws.com/AWSServiceRoleForApplicationMigrationService"
]
},
"Action": [
"kms:ReEncrypt*",
"kms:GenerateDataKey*"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": "123456789",
"kms:ViaService": "ec2.us-east-1.amazonaws.com"
}
}
}
]
}
)
}
terraform plan output
+ "kms:CallerAccount" = "123456789"
+ "kms:GranteePrincipal" = "arn:aws:iam::123456789:role/aws-service-role/mgn.amazonaws.com/AWSServiceRoleForApplicationMigrationService"
}
}
+ Effect = "Allow"
+ Principal = {
+ AWS = "arn:aws:iam::123456789:root"
}
+ Resource = "*"
+ Sid = "Sid#2"
},
+ {
+ Action = [
+ "kms:ReEncrypt*",
+ "kms:GenerateDataKey*",
]
+ Condition = {
+ StringEquals = {
+ "kms:CallerAccount" = "123456789"
+ "kms:ViaService" = "ec2.***.amazonaws.com"
}
}
+ Effect = "Allow"
+ Principal = {
+ AWS = [
+ "arn:aws:iam::123456789:root",
+ "arn:aws:iam::123456789:role/aws-service-role/mgn.amazonaws.com/AWSServiceRoleForApplicationMigrationService",
]
}
+ Resource = "*"
+ Sid = "Sid#1"
},
]
+ Version = "2012-10-17"
}
)
}
I don't understand why the kms:ViaService = ec2..amazonaws.com in output with three star () rather than exact region name.
Steps To Reproduce
provider "aws" {
region = var.region
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
Which version of the app are you using?
1.0.0, 1.1.0, 1.2.0
resource/aws_kms_key: Add custom_key_store_id attribute
https://github.com/hashicorp/terraform-provider-aws/releases/tag/v4.33.0
- resource/aws_kms_key: Add custom_key_store_id attribute (hashicorp/terraform-provider-aws#24787)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.