aws-lambda-kms-encryption/iam.tf at master · goci-io/aws-lambda-kms-encryption · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

data "aws_iam_policy_document" "trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      identifiers = ["lambda.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_iam_role" "lambda" {
  name               = module.region_label.id
  tags               = module.region_label.tags
  assume_role_policy = data.aws_iam_policy_document.trust.json
}

data "aws_iam_policy_document" "policy" {
  statement {
    effect    = "Allow"
    resources = [aws_kms_key.default.arn]
    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:GenerateRandom",
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      format("arn:aws:logs:%s:%s:log-group:%s:log-stream:*", local.aws_region, local.aws_account_id, aws_cloudwatch_log_group.encrypt_log_group.name),
      format("arn:aws:logs:%s:%s:log-group:%s:log-stream:*", local.aws_region, local.aws_account_id, aws_cloudwatch_log_group.decrypt_log_group.name),
    ]
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:DescribeLogStreams",
    ]
  }
}

resource "aws_iam_role_policy" "lambda_access" {
  name   = module.region_label.id
  role   = aws_iam_role.lambda.id
  policy = data.aws_iam_policy_document.policy.json
}