Allow S3-to-S3-copier lambda access to the queues KMS key

ryanbratten · ryanbratten · commit a5f17568279a · 2022-07-06T16:21:24.000+01:00
diff --git a/terraform/modules/db-snapshot-to-s3/40-s3-to-s3-copier-lambda.tf b/terraform/modules/db-snapshot-to-s3/40-s3-to-s3-copier-lambda.tf
@@ -101,6 +101,17 @@ data "aws_iam_policy_document" "s3_to_s3_copier_lambda" {
       ]
     }
   }
+
+  statement {
+    actions = [
+      "kms:GenerateDataKey*",
+      "kms:Decrypt"
+    ]
+    effect = "Allow"
+    resources = [
+      aws_kms_key.s3_to_s3_copier_kms_key.arn
+    ]
+  }
 }
 
 resource "aws_iam_policy" "s3_to_s3_copier_lambda" {

Original file line number	Diff line number	Diff line change
`@@ -101,6 +101,17 @@ data "aws_iam_policy_document" "s3_to_s3_copier_lambda" {`
`101`	`101`	`]`
`102`	`102`	`}`
`103`	`103`	`}`
	`104`	`+`
	`105`	`+ statement {`
	`106`	`+ actions = [`
	`107`	`+ "kms:GenerateDataKey*",`
	`108`	`+ "kms:Decrypt"`
	`109`	`+ ]`
	`110`	`+ effect = "Allow"`
	`111`	`+ resources = [`
	`112`	`+ aws_kms_key.s3_to_s3_copier_kms_key.arn`
	`113`	`+ ]`
	`114`	`+ }`
`104`	`115`	`}`
`105`	`116`
`106`	`117`	`resource "aws_iam_policy" "s3_to_s3_copier_lambda" {`