search

Coalfire-CF / terraform-aws-account-setup

Coalfire AWS Account Setup Terraform Module
https://coalfire.com/opensource
MIT License
2 stars 1 forks source link

KMS Key creation fails when entering "application_account_numbers = [""] #27

Open harrison-dottery-cf opened 3 months ago

harrison-dottery-cf commented 3 months ago

Describe the bug KMS Key creation fails when entering "application_account_numbers = [""]

To Reproduce

  1. Fill out application_account_numbers = [""] in main.tf of day0 mgmt AWS Ramppak
  2. Terraform apply

Expected behavior KMS Key creation success

Screenshots │ Error: creating KMS Key: operation error KMS: CreateKey, https response error StatusCode: 400, RequestID: 904f66d0-65dc-4319-b2ef-96c94b9b0046, MalformedPolicyDocumentException: Policy contains a statement with one or more invalid principals. │ │ with module.account-setup.module.config_kms_key[0].aws_kms_key.kms_key, │ on .terraform/modules/account-setup.config_kms_key/main.tf line 1, in resource "aws_kms_key" "kms_key": │ 1: resource "aws_kms_key" "kms_key" {

image

Additional context If you remove the quotes, and do it like this application_account_numbers = [] it will work but cause issues with bucket policies

jemadd04 commented 3 weeks ago

Opened a PR to be reviewed to address this issue. Tested successfully in Coalfire GovCloud sandbox environment. Related PR also open for terraform-aws-securitycore module to address bucket policy creation for s3-tstate based on list of app account numbers.