|
| 1 | + , |
| 2 | + "${stack}RdsSnapshotCmk": { |
| 3 | + "Type": "AWS::KMS::Key", |
| 4 | + "Properties": { |
| 5 | + "Description": "The encryption key for ${stack} stack RDS snapshots", |
| 6 | + "EnableKeyRotation": true, |
| 7 | + "KeyPolicy": { |
| 8 | + "Version": "2012-10-17", |
| 9 | + "Id": "key-default-1", |
| 10 | + "Statement": [ |
| 11 | + { |
| 12 | + "Sid": "Enable IAM User Permissions", |
| 13 | + "Effect": "Allow", |
| 14 | + "Principal": { "AWS": "arn:aws:iam::#[[${AWS::AccountId}]]#:root" }, |
| 15 | + "Action": "kms:*", |
| 16 | + "Resource": "*" |
| 17 | + }, |
| 18 | + { |
| 19 | + "Sid": "Allow access for Key Administrators", |
| 20 | + "Effect": "Allow", |
| 21 | + "Principal": { |
| 22 | + "AWS": |
| 23 | +#if(${stack} == 'prod') |
| 24 | + { "Fn::Sub": "arn:aws:iam::#[[${AWS::AccountId}]]#:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Administrator_6620166dd0e7f1b6" } |
| 25 | +#else |
| 26 | + { "Fn::Sub": "arn:aws:iam::#[[${AWS::AccountId}]]#:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Administrator_693a85eb20cd5043" } |
| 27 | +#end |
| 28 | + }, |
| 29 | + "Action": [ |
| 30 | + "kms:Create*", |
| 31 | + "kms:Describe*", |
| 32 | + "kms:Enable*", |
| 33 | + "kms:List*", |
| 34 | + "kms:Put*", |
| 35 | + "kms:Update*", |
| 36 | + "kms:Revoke*", |
| 37 | + "kms:Disable*", |
| 38 | + "kms:Get*", |
| 39 | + "kms:Delete*", |
| 40 | + "kms:TagResource", |
| 41 | + "kms:UntagResource", |
| 42 | + "kms:ScheduleKeyDeletion", |
| 43 | + "kms:CancelKeyDeletion", |
| 44 | + "kms:RotateKeyOnDemand" |
| 45 | + ], |
| 46 | + "Resource": "*" |
| 47 | + }, |
| 48 | + { |
| 49 | + "Sid": "Allow use of the key", |
| 50 | + "Effect": "Allow", |
| 51 | + "Principal": { "AWS": "arn:aws:iam::766808016710:root" }, |
| 52 | + "Action": [ |
| 53 | + "kms:Decrypt", |
| 54 | + "kms:DescribeKey" |
| 55 | + ], |
| 56 | + "Resource": "*" |
| 57 | + }, |
| 58 | + { |
| 59 | + "Sid": "Allow attachment of persistent resources", |
| 60 | + "Effect": "Allow", |
| 61 | + "Principal": { "AWS": "arn:aws:iam::766808016710:root" }, |
| 62 | + "Action": [ |
| 63 | + "kms:CreateGrant", |
| 64 | + "kms:ListGrants", |
| 65 | + "kms:RevokeGrant" |
| 66 | + ], |
| 67 | + "Resource": "*", |
| 68 | + "Condition": { |
| 69 | + "StringEquals": { "kms:ViaService": "rds.us-east-1.amazonaws.com" }, |
| 70 | + "Bool": { "kms:GrantIsForAWSResource": "true" } |
| 71 | + } |
| 72 | + }, |
| 73 | + { |
| 74 | + "Sid": "AllowRDSToDecryptSourceSnapshotForExport", |
| 75 | + "Effect": "Allow", |
| 76 | + "Principal": { "Service": "export.rds.amazonaws.com" }, |
| 77 | + "Action": [ |
| 78 | + "kms:Decrypt", |
| 79 | + "kms:DescribeKey" |
| 80 | + ], |
| 81 | + "Resource": "*" |
| 82 | + } |
| 83 | + ] |
| 84 | + } |
| 85 | + } |
| 86 | + }, |
| 87 | + "${stack}RdsSnapshotCmkAlias": { |
| 88 | + "Type": "AWS::KMS::Alias", |
| 89 | + "Properties": { |
| 90 | + "AliasName": "alias/synapse/${stack}/rds-snapshot-cmk", |
| 91 | + "TargetKeyId": { "Ref": "${stack}RdsSnapshotCmk" } |
| 92 | + } |
| 93 | + } |
0 commit comments