sathish97625
diff --git a/Collapse file
‎kms/main.tf‎
Copy file name to clipboard
+91Lines changed: 91 additions & 0 deletions b/Collapse file
‎kms/main.tf‎
Copy file name to clipboard
+91Lines changed: 91 additions & 0 deletions
@@ -0,0 +1,91 @@
+resource "aws_kms_key" "my-kms-key" {
+  description         = "My KMS Keys for Data Encryption"
+  enable_key_rotation = true
+
+  tags {
+    Name = "my-kms-keys"
+  }
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Id": "key-consolepolicy-3",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::123456789:root"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "Allow access for Key Administrators",
+      "Effect": "Allow",
+      "Principal": {
+          "AWS": [
+          "arn:aws:iam::123456789:user/plakhera"
+        ]
+      },
+      "Action": [
+        "kms:Create*",
+        "kms:Describe*",
+        "kms:Enable*",
+        "kms:List*",
+        "kms:Put*",
+        "kms:Update*",
+        "kms:Revoke*",
+        "kms:Disable*",
+        "kms:Get*",
+        "kms:Delete*",
+        "kms:TagResource",
+        "kms:UntagResource",
+        "kms:ScheduleKeyDeletion",
+        "kms:CancelKeyDeletion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "Allow use of the key",
+      "Effect": "Allow",
+            "Principal": {
+          "AWS": [
+          "arn:aws:iam::123456789:user/plakhera"
+
+        ]
+      },
+      "Action": [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "Allow attachment of persistent resources",
+      "Effect": "Allow",
+            "Principal": {
+          "AWS": [
+          "arn:aws:iam::123456789:user/plakhera",
+
+        ]
+      },
+      "Action": [
+        "kms:CreateGrant",
+        "kms:ListGrants",
+        "kms:RevokeGrant"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_kms_alias" "smc-kms-alias" {
+  target_key_id = "${aws_kms_key.my-kms-key.key_id}"
+  name          = "alias/my-terraform-final-encryption-key"
+}