77e4371460
* aws_kms: (integration tests) Use module_defaults to reduce the copy and paste * aws_kms: (integration tests) make sure policy option functions. * aws_kms: (integration tests) Move iam_role creation to start of playbook. iam_roles aren't fully created when iam_role completes, there's a delay on the Amazon side before they're fully recognised. * aws_kms: Update policy on existing keys (when passed)
72 lines
2 KiB
Django/Jinja
72 lines
2 KiB
Django/Jinja
{
|
|
"Id": "key-consolepolicy-3",
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "Enable IAM User Permissions",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "arn:aws:iam::{{ aws_caller_info.account }}:root"
|
|
},
|
|
"Action": "kms:*",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "Allow access for Key Administrators",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "{{ aws_caller_info.arn }}"
|
|
},
|
|
"Action": [
|
|
"kms:Create*",
|
|
"kms:Describe*",
|
|
"kms:Enable*",
|
|
"kms:List*",
|
|
"kms:Put*",
|
|
"kms:Update*",
|
|
"kms:Revoke*",
|
|
"kms:Disable*",
|
|
"kms:Get*",
|
|
"kms:Delete*",
|
|
"kms:TagResource",
|
|
"kms:UntagResource",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:CancelKeyDeletion"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "Allow use of the key",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "{{ aws_caller_info.arn }}"
|
|
},
|
|
"Action": [
|
|
"kms:Encrypt",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:GenerateDataKey*",
|
|
"kms:DescribeKey"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "Allow attachment of persistent resources",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "{{ aws_caller_info.arn }}"
|
|
},
|
|
"Action": [
|
|
"kms:CreateGrant",
|
|
"kms:ListGrants",
|
|
"kms:RevokeGrant"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"Bool": {
|
|
"kms:GrantIsForAWSResource": "true"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|