fix: Update KMS key policy to prevent public access. (#41)

Author: jamesiarmes

kms.tf

@@ -3,10 +3,11 @@ resource "aws_kms_key" "fargate" {
   deletion_window_in_days = var.key_recovery_period
   enable_key_rotation     = true
   policy = jsonencode(yamldecode(templatefile("${path.module}/templates/key-policy.yaml.tftpl", {
-    account_id : data.aws_caller_identity.identity.account_id,
-    partition : data.aws_partition.current.partition,
-    region : data.aws_region.current.name,
-    repository_name : local.prefix,
+    account_id : data.aws_caller_identity.identity.account_id
+    ecs_roles : [aws_iam_role.execution.arn, aws_iam_role.task.arn]
+    partition : data.aws_partition.current.partition
+    region : data.aws_region.current.name
+    repository_name : local.prefix
   })))
 
   tags = var.tags

templates/key-policy.yaml.tftpl

@@ -1,4 +1,4 @@
-Version: '2012-10-17'
+Version: "2012-10-17"
 Id: Fargate hosting key policy
 Statement:
 - Sid: Enable IAM User Permissions
@@ -20,11 +20,14 @@ Statement:
   Condition:
     StringEquals:
       kms:CallerAccount: "${account_id}"
-      kms:EncryptionContext:aws:ecr:arn: arn:${partition}:ecr:${region}:${account_id}:repository/${repository_name}
-- Sid: Allow Fargate containers to encrypt objects
+      kms:EncryptionContext:aws:ecr:arn: "arn:${partition}:ecr:${region}:${account_id}:repository/${repository_name}"
+- Sid: Allow ECS containers to encrypt objects
   Effect: Allow
   Resource: "*"
   Principal:
-    AWS: "*"
+    AWS:
+    %{ for arn in ecs_roles ~}
+    - "${arn}"
+    %{ endfor }
   Action:
   - kms:GenerateDataKey*