feat: create KMS key decryption policy for S3

[alexandermarston]

Description

• Updates the Coralogix AWS Shipper module to accept a s3_bucket_kms_arn variable, to dynamically create the inline policy required for decrypting objects using a KMS Key.

How Has This Been Tested?

Tested locally.

Omitting the variable results in no changes, including the variable results in a new addition to the policy statement.

10:28:43.055 STDOUT terraform: Terraform will perform the following actions:
10:28:43.055 STDOUT terraform:   # aws_iam_policy.lambda_policy["integration"] will be updated in-place
10:28:43.055 STDOUT terraform:   ~ resource "aws_iam_policy" "lambda_policy" {
10:28:43.055 STDOUT terraform:         id               = "arn:aws:iam::xxx:policy/policy-for-coralogix-lambda-dgiK80"
10:28:43.055 STDOUT terraform:         name             = "policy-for-coralogix-lambda-dgiK80"
10:28:43.055 STDOUT terraform:       ~ policy           = jsonencode(

Checklist:

• I have updated the relevant example in the examples directory for the module.
• I have updated the relevant test file for the module.
• This change does not affect module (e.g. it's readme file change)

[CLAassistant]

All committers have signed the CLA.

[guyrenny]

Hey @alexandermarston, looks good, just 2 small things:

1. If you can add the variable to the README file
2. In order to release a new version we require the PR title to start with feat: <title>, and the commit messages to also be in the formate of feat: . You can see more information about it here

[alexandermarston]

Hey @alexandermarston, looks good, just 2 small things:

1. If you can add the variable to the README file
2. In order to release a new version we require the PR title to start with feat: <title>, and the commit messages to also be in the formate of feat: . You can see more information about it here

Thanks for the feedback.

I was wondering if it actually makes more sense to just always create the kms:decrypt policy for * resources when S3 is the backend, rather than a specific KMS key ARN. WDYT?

[guyrenny]

Hey @alexandermarston, looks good, just 2 small things:

1. If you can add the variable to the README file
2. In order to release a new version we require the PR title to start with feat: <title>, and the commit messages to also be in the formate of feat: . You can see more information about it here

Thanks for the feedback.

I was wondering if it actually makes more sense to just always create the kms:decrypt policy for * resources when S3 is the backend, rather than a specific KMS key ARN. WDYT?

We prefer to limit the amount of wild cards that we use in the module to avoid security issues, a lot of time we are requested to remove wild cards from the code, so unfortunately, I think that we should leave it as is right now

[alexandermarston]

Hey @alexandermarston, looks good, just 2 small things:

1. If you can add the variable to the README file
2. In order to release a new version we require the PR title to start with feat: <title>, and the commit messages to also be in the formate of feat: . You can see more information about it here

Thanks for the feedback.
I was wondering if it actually makes more sense to just always create the kms:decrypt policy for * resources when S3 is the backend, rather than a specific KMS key ARN. WDYT?

We prefer to limit the amount of wild cards that we use in the module to avoid security issues, a lot of time we are requested to remove wild cards from the code, so unfortunately, I think that we should leave it as is right now

Got ya.

I've made the changes you've requested.

[guyrenny]

@alexandermarston I have approved the PR, but I just noticed that not all of the Commits have verified signatures, so I can't merge the PR at the moment, if you could sign the unsigned commits please.

[alexandermarston]

@alexandermarston I have approved the PR, but I just noticed that not all of the Commits have verified signatures, so I can't merge the PR at the moment, if you could sign the unsigned commits please.

Sorry - forgot to resign all of the commit history. It should be sorted now.

[github-actions]

🎉 This PR is included in version 2.8.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀