Closed richardj-bsquare closed 2 years ago
Re-running the apply does not fix the issue, i.e. the same error re-occurs.
I'm beginning to wonder whether this is an aspect of us using an IAM role to apply our terraform rather than a user account. Looking at some of the policies it looks like they only offer user access and not IAM role access.
Short description AWS KMS performs safety checks when a key policy is created. One safety check confirms that the principal in the key policy has the required permissions to make the CreateKey API and PutKeyPolicy API. This check eliminates the possibility of the KMS key becoming unmanageable, which means that you can't change the key policy or delete the key.
Important: Be sure that the key policy that you create allows the current user to administer the KMS key.
I'm pretty sure it's the fact that I'm using a role to do the terraform... I think this policy:
Needs a role_arn option equivalent to the root account one to allow full control of the key from the role.
Nevermind, noticed that the regionally specified providers were all pointing to a different account, so I basically needed to wrap this module in another module that sets the default AWS provider to one with the correct assume role. Then the KMS key roles, etc. were in the correct specified account.
Describe the bug
Policy errors during terraform apply using module with some features enabled and some disabled.
Versions
Reproduction
An initial deploy with the following configuration, as I'm trying to introduce baseline feature by feature.
Expected behavior
Creation without errors...
Actual behavior
Additional context
I'm wondering if certain enabled flags are dependent on others to function correctly?
I'm wondering if the latter of the errors is related to: https://github.com/nozaq/terraform-aws-secure-baseline/issues/98, i.e. the same needs to be done for config baseline as has been done for cloudtrail baseline?