allow the task kms permissions

schubergphilis · Oct 2, 2024 · 2c11b3b · 2c11b3b
1 parent a3cb664
commit 2c11b3b
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -120,6 +120,22 @@ data "aws_iam_policy_document" "ecs_task" {
     actions   = ["s3:PutObject*"]
     resources = ["arn:aws:s3:::${local.bucket_name_with_prefix}*"]
   }
+
+  dynamic "statement" {
+    for_each = var.kms_key_arn != null ? { create = true } : {}
+
+    content {
+      sid       = "AllowUseKMS"
+      resources = [var.kms_key_arn]
+
+      actions = [
+        "kms:Decrypt",
+        "kms:Encrypt",
+        "kms:GenerateDataKey*",
+        "kms:ReEncrypt*",
+      ]
+    }
+  }
 }
 
 module "iam_role" {