Allow for kms:Decrypt

[shayfisher]

No IAM policy grants kms:Decrypt which is needed in order to decrypt the secret when KMS (CMK) is used.

[jmolnar-zscaler]

@shayfisher there are two ways to add customer managed key access. Either at the individual KMS policy with Instance Profile/Role or at the Instance Profile/Role as you are requesting. Generally, we wouldn't want to leave default resource access to * either.

There is an existing variable byo_kms_key_alias used for customer managed key for EBS encryption. Would you be utilizing the same CMK for EBS and Secrets Manager or expect these two to be different?

[shayfisher]

Hi @jmolnar-zscaler
I expect them to be different.
Because I usually create resources with IaC I tend to split keys, each for each component.
So you are suggesting to add a new variable and have it as the permitted resource instead of “*”?

[shayfisher]

@jmolnar-zscaler should I add a new variable representing an external kms key id and push an updated commit?