kms-policy.json

{
  "Id": "kms-key-policy-0001",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::${account_id}:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::${account_id}:role/EtleapApp${resource_name_suffix}"
        ]
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Allow attachment of persistent resources",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::${account_id}:role/EtleapApp${resource_name_suffix}"
        ]
      },
      "Action": [
        "kms:CreateGrant",
        "kms:ListGrants",
        "kms:RevokeGrant"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "kms:GrantIsForAWSResource": "true"
        }
      }
    }
    %{ for policy in additional_policies }
    ,{
      %{ if policy.Sid != null }
        "Sid": "${policy.Sid}",
      %{ endif }
        "Effect": "${policy.Effect}",
        "Principal": ${jsonencode(policy.Principal)},
        "Action": ${jsonencode(policy.Action)},
        "Resource": "${policy.Resource}"
      %{ if policy.Condition != null }
        ,"Condition": ${jsonencode(policy.Condition)}
      %{ endif }
    }
    %{ endfor }
  ]
}