1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# locals =====================================================================

data "aws_caller_identity" "current" {}
data "aws_partition" "current" {}

locals {
  tags = merge(
    {
      ManagedBy = "terraform"
      Module    = "security/kms"
    },
    var.tags,
  )

  default_policy = jsonencode({
    Version = "2012-10-17"
    Statement = concat(
      [{
        Sid    = "Enable IAM User Permissions"
        Effect = "Allow"
        Principal = {
          AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
        }
        Action   = ["kms:*"]
        Resource = ["*"]
      }],
      length(var.cross_account_principals) > 0 ? [{
        Sid    = "AllowCrossAccountUse"
        Effect = "Allow"
        Principal = {
          AWS = var.cross_account_principals
        }
        Action = [
          "kms:Decrypt",
          "kms:DescribeKey",
          "kms:Encrypt",
          "kms:GenerateDataKey*",
          "kms:ReEncrypt*",
        ]
        Resource = ["*"]
      }] : [],
    )
  })

  effective_policy = coalesce(var.policy, local.default_policy)
}