README.yaml

---
#
# This is the canonical configuration for the `README.md`
# Run `make readme` to rebuild the `README.md`
#

# Name of this project
name : Terraform AWS KMS

# License of this project
license: "APACHE"

# Canonical GitHub repo
github_repo: clouddrove/terraform-aws-kms

# Badges to display
badges:
  - name: "Latest Release"
    image: "https://img.shields.io/github/release/clouddrove/terraform-aws-kms.svg"
    url: "https://github.com/clouddrove/terraform-aws-kms/releases/latest"
  - name: "tfsec"
    image: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml/badge.svg"
    url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml"
  - name: "Licence"
    image: "https://img.shields.io/badge/License-APACHE-blue.svg"
    url: "LICENSE.md"
  - name: "Changelog"
    image: "https://img.shields.io/badge/Changelog-blue"
    url: "CHANGELOG.md"

prerequesties:
  - name: Terraform
    url: https://learn.hashicorp.com/terraform/getting-started/install.html
    version: ">= 1.6.6"

providers:
  - name: aws
    url: https://aws.amazon.com/
    version: ">= 5.31.0"

module_dependencies:
  - name: Labels Module
    url: https://github.com/clouddrove/terraform-aws-labels
    description: Provides resource tagging.

description: |-
  This terraform module creates a KMS Customer Master Key (CMK) and its alias.


# How to use this project
usage : |-
  ### Simple Example
  Here is an example of how you can use this module in your inventory structure:
  ```hcl
    module "kms_key" {
      source      = "clouddrove/kms/aws"
      version     = "1.3.0"
      name        = "kms"
      environment = "test"
      label_order = ["name", "environment"]
    
      deletion_window_in_days = 7
      alias                   = "alias/cloudtrail_Name"
      enabled                 = true
      kms_key_enabled         = true
      multi_region            = true
      create_external_enabled = true
      valid_to                = "2023-11-21T23:20:50Z"
      key_material_base64     = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
      policy                  = data.aws_iam_policy_document.default.json
    }
      
      data "aws_caller_identity" "current" {}
      data "aws_partition" "current" {}
      
      ##----------------------------------------------------------------------------------
      ## Data block called to get Permissions that will be used in creating policy.
      ##----------------------------------------------------------------------------------
      data "aws_iam_policy_document" "default" {
      version = "2012-10-17"
      statement {
      sid    = "Enable IAM User Permissions"
      effect = "Allow"
      principals {
      type = "AWS"
      identifiers = [
      format(
      "arn:%s:iam::%s:root",
      join("", data.aws_partition.current.*.partition),
      data.aws_caller_identity.current.account_id
      )
      ]
      }
      actions   = ["kms:*"]
      resources = ["*"]
      }
      statement {
      sid    = "Allow CloudTrail to encrypt logs"
      effect = "Allow"
      principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
      }
      actions   = ["kms:GenerateDataKey*"]
      resources = ["*"]
      condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:cloudtrail:arn"
      values   = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
      }
      }
    
      statement {
      sid    = "Allow CloudTrail to describe key"
      effect = "Allow"
      principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
      }
      actions   = ["kms:DescribeKey"]
      resources = ["*"]
      }
    
      statement {
      sid    = "Allow principals in the account to decrypt log files"
      effect = "Allow"
      principals {
      type = "AWS"
      identifiers = [
      format(
      "arn:%s:iam::%s:root",
      join("", data.aws_partition.current.*.partition),
      data.aws_caller_identity.current.account_id
      )
      ]
      }
      actions = [
      "kms:Decrypt",
      "kms:ReEncryptFrom"
      ]
      resources = ["*"]
      condition {
      test     = "StringEquals"
      variable = "kms:CallerAccount"
      values = [
      "XXXXXXXXXXXX"]
      }
      condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:cloudtrail:arn"
      values   = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
      }
      }
    
      statement {
      sid    = "Allow alias creation during setup"
      effect = "Allow"
      principals {
      type = "AWS"
      identifiers = [
      format(
      "arn:%s:iam::%s:root",
      join("", data.aws_partition.current.*.partition),
      data.aws_caller_identity.current.account_id
      )
      ]
      }
      actions   = ["kms:CreateAlias"]
      resources = ["*"]
      }
    }
  ```