feat(kms): Make kms key customizable (#15)

wandb · Mar 15, 2022 · 82bad72 · 82bad72
1 parent 8ddf9f9
commit 82bad72
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 2 deletions.
diff --git a/main.tf b/main.tf
@@ -4,7 +4,7 @@ module "kms" {
   key_alias           = var.kms_key_alias == null ? "${var.namespace}-kms-alias" : var.kms_key_alias
   key_deletion_window = var.kms_key_deletion_window
 
-  iam_principal_arn = ""
+  key_policy = var.kms_key_policy
 }
 
 locals {

diff --git a/modules/kms/main.tf b/modules/kms/main.tf
@@ -5,7 +5,7 @@ resource "aws_kms_key" "key" {
   description             = "AWS KMS Customer-managed key to encrypt Weights & Biases resources"
   key_usage               = "ENCRYPT_DECRYPT"
 
-  policy = jsonencode({
+  policy = var.key_policy != "" ? var.key_policy : jsonencode({
     "Version" : "2012-10-17",
     "Statement" : [
       {

diff --git a/modules/kms/variables.tf b/modules/kms/variables.tf
@@ -11,4 +11,11 @@ variable "key_deletion_window" {
 variable "iam_principal_arn" {
   description = "The IAM principal (role or user) ARN that will be authorized to use the key."
   type        = string
+  default     = ""
+}
+
+variable "key_policy" {
+  description = "The policy that will define the permissions for the kms key."
+  type        = string
+  default     = ""
 }
diff --git a/variables.tf b/variables.tf
@@ -97,6 +97,11 @@ variable "kms_key_deletion_window" {
   default     = 7
 }
 
+variable "kms_key_policy" {
+  type        = string
+  description = "The policy that will define the permissions for the kms key."
+  default     = ""
+}
 
 ##########################################
 # Network                                #