Allow keys to access all resources in service as per AWS docs (#787)

* Allow keys to access all resources in service as per AWS docs

* Re-add kms decrypt permissions on lambdas

Co-authored-by: b-dalton <[email protected]>

Author: ryanbratten

terraform/core/05-departments.tf

@@ -101,6 +101,15 @@ data "aws_iam_policy_document" "glue_failure_notification_lambda" {
       "arn:aws:sns:*:*:glue-failure-notification-*"
     ]
   }
+
+  statement {
+    actions = [
+      "kms:GenerateDataKey*",
+      "kms:Decrypt"
+    ]
+    effect    = "Allow"
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "glue_failure_notification_lambda" {
@@ -193,9 +202,7 @@ data "aws_iam_policy_document" "admin_failure_notifications_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [
-      aws_lambda_function.glue_failure_notification_lambda.arn
-    ]
+    resources = ["*"]
   }
 }
 

terraform/core/28-glue-error-notifications.tf

@@ -107,6 +107,7 @@ data "aws_iam_policy_document" "rds_snapshot_to_s3_lambda" {
     effect = "Allow"
     resources = [
       aws_kms_key.s3_to_s3_copier_kms_key.arn,
+      aws_kms_key.rds_snapshot_to_s3_kms_key.arn
     ]
   }
 }

terraform/modules/db-snapshot-to-s3/20-rds-to-s3-lambda.tf

@@ -57,9 +57,7 @@ data "aws_iam_policy_document" "rds_snapshot_to_s3_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [
-      data.aws_sns_topic.rds_snapshot_to_s3.arn
-    ]
+    resources = ["*"]
   }
 
   statement {
@@ -73,7 +71,7 @@ data "aws_iam_policy_document" "rds_snapshot_to_s3_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [for item in var.rds_instance_ids : "arn:aws:rds:eu-west-2:${data.aws_caller_identity.current.account_id}:db:${item}"]
+    resources = ["*"]
   }
 
   statement {
@@ -87,9 +85,7 @@ data "aws_iam_policy_document" "rds_snapshot_to_s3_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [
-      aws_lambda_function.rds_snapshot_to_s3_lambda.arn
-    ]
+    resources = ["*"]
   }
 }
 

terraform/modules/db-snapshot-to-s3/25-rds-to-s3-queue.tf

@@ -52,9 +52,7 @@ data "aws_iam_policy_document" "s3_to_s3_copier_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [
-      aws_lambda_function.s3_to_s3_copier_lambda.arn
-    ]
+    resources = ["*"]
   }
 }
 
@@ -74,6 +72,17 @@ data "aws_iam_policy_document" "s3_to_s3_copier" {
       aws_sqs_queue.s3_to_s3_copier.arn
     ]
   }
+
+  statement {
+    actions = [
+      "kms:GenerateDataKey*",
+      "kms:Decrypt"
+    ]
+    effect = "Allow"
+    resources = [
+      aws_kms_key.s3_to_s3_copier_kms_key.arn,
+    ]
+  }
 }
 
 resource "aws_sqs_queue_policy" "s3_copier_to_s3" {

terraform/modules/db-snapshot-to-s3/45-s3-to-s3-copier-queue.tf

@@ -131,9 +131,4 @@ variable "redshift_ip_addresses" {
 variable "redshift_port" {
   description = "Port that the redshift cluster is running on"
   type        = number
-}
-
-variable "glue_failure_notification_lambda_arn" {
-  description = "Arn of the lambda that will publish to the glue failure notification sns topic"
-  type        = string
 }

terraform/modules/department/01-inputs-required.tf

@@ -41,7 +41,7 @@ data "aws_iam_policy_document" "glue_jobs_kms_key_policy" {
       type        = "Service"
     }
 
-    resources = [var.glue_failure_notification_lambda_arn]
+    resources = ["*"]
   }
 }