kms keys and roles per account, wip
"Enabled": true,
"EnableKeyRotation": true,
"KeyPolicy": {
- "Id": "DefaultKmsPolicy",
+ "Id": "BucketKmsPolicy",
"Version": "2012-10-17",
"Statement": [
- {
- "Sid": "Enable IAM User Permissions",
- "Effect": "Allow",
- "Principal": {
- "AWS": [
- {
- "Fn::Join": [
- ":",
- [
- "arn:aws:iam:",
- {
- "Ref": "AWS::AccountId"
- },
- "root"
- ]
- ]
- }
- ]
- },
- "Action": "kms:*",
- "Resource": "*"
- },
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
- "Resource": "*"
+ "Resource": "*",
+ "Condition": {
+ "StringEquals": {
+ "kms:ViaService": {
+ "Fn::Join": [
+ "",
+ [
+ "s3.",
+ {
+ "Ref": "AWS::Region"
+ },
+ ".amazonaws.com"
+ ]
+ ]
+ }
+ }
+ }
},
{
"Sid": "Allow attachment of persistent resources",
"Action": [
"kms:Decrypt"
],
- "Resource": "*"
+ "Resource": "*",
+ "Condition": {
+ "StringEquals": {
+ "kms:ViaService": {
+ "Fn::Join": [
+ "",
+ [
+ "s3.",
+ {
+ "Ref": "AWS::Region"
+ },
+ ".amazonaws.com"
+ ]
+ ]
+ }
+ }
+ }
},
{
"Sid": "Allow encrypting under this key.",
"kms:Encrypt",
"kms:GenerateDataKey"
],
- "Resource": "*"
+ "Resource": "*",
+ "Condition": {
+ "StringEquals": {
+ "kms:ViaService": {
+ "Fn::Join": [
+ "",
+ [
+ "s3.",
+ {
+ "Ref": "AWS::Region"
+ },
+ ".amazonaws.com"
+ ]
+ ]
+ }
+ }
+ }
}
]
}
"Ref": "BucketKey"
}
}
+ },
+ "AdminKmsRole": {
+ "Description": "AdminKmsRole",
+ "Value": {
+ "Ref": "AdminKmsRole"
+ },
+ "Export": {
+ "Name": {
+ "Ref": "AdminKmsRole"
+ }
+ }
}
}
}
