fix: Makes bucket kms key conditional (#29)

* makes bucket kms key conditional * update default value
wandb · Jun 7, 2022 · 163625e · 163625e
1 parent e0f731b
commit 163625e
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 21 deletions.
diff --git a/modules/app_eks/main.tf b/modules/app_eks/main.tf
@@ -65,26 +65,29 @@ resource "aws_iam_role" "node" {
   }
 
   # Encrypt and decrypt with KMS
-  inline_policy {
-    name = "${var.namespace}-node-kms-policy"
-    policy = jsonencode({
-      "Version" : "2012-10-17",
-      "Statement" : [
-        {
-          "Effect" : "Allow",
-          "Action" : [
-            "kms:Encrypt",
-            "kms:Decrypt",
-            "kms:ReEncrypt*",
-            "kms:GenerateDataKey*",
-            "kms:DescribeKey"
-          ],
-          "Resource" : [
-            "${var.bucket_kms_key_arn}"
-          ]
-        }
-      ]
-    })
+  dynamic "inline_policy" {
+    for_each = var.bucket_kms_key_arn == "" ? [] : [1]
+    content {
+      name = "${var.namespace}-node-kms-policy"
+      policy = jsonencode({
+        "Version" : "2012-10-17",
+        "Statement" : [
+          {
+            "Effect" : "Allow",
+            "Action" : [
+              "kms:Encrypt",
+              "kms:Decrypt",
+              "kms:ReEncrypt*",
+              "kms:GenerateDataKey*",
+              "kms:DescribeKey"
+            ],
+            "Resource" : [
+              "${var.bucket_kms_key_arn}"
+            ]
+          }
+        ]
+      })
+    }
   }
 
   # Publish cloudwatch metrics

diff --git a/modules/app_eks/variables.tf b/modules/app_eks/variables.tf
@@ -39,7 +39,7 @@ variable "bucket_sqs_queue_arn" {
 }
 
 variable "bucket_kms_key_arn" {
-  description = "(Required) The Amazon Resource Name of the KMS key with which S3 storage bucket objects will be encrypted."
+  description = "The Amazon Resource Name of the KMS key with which S3 storage bucket objects will be encrypted."
   type        = string
 }