2256 encrypt cloudtrail logs (#2265)

* Add encrypt and decrypt permissions to KMS policy * Remove said permissions from CloudTrail Policy
cisagov · Sep 29, 2023 · 45f04c4 · 45f04c4
1 parent 03a5f69
commit 45f04c4
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 25 deletions.
diff --git a/infrastructure/cloudtrail.tf b/infrastructure/cloudtrail.tf
@@ -138,29 +138,4 @@ resource "aws_iam_role_policy" "cloudtrail_cloudwatch_policy" {
       Resource = "arn:aws:logs:*"
     }]
   })
-}
-
-resource "aws_iam_role_policy" "cloudtrail_kms_policy" {
-  name_prefix = "crossfeed-cloudtrail-kms-${var.stage}"
-  role        = aws_iam_role.cloudtrail_role.id
-  policy = jsonencode({
-    Version = "2012-10-17",
-    Statement = [{
-      Action = [
-        "kms:GenerateDataKey*",
-        "kms:Decrypt*",
-        "kms:DescribeKey"
-      ],
-      Effect   = "Allow",
-      Resource = aws_kms_key.key.arn
-      Condition = {
-        StringEquals : {
-          "aws:SourceArn" : "arn:aws:cloudtrail:${var.aws_region}:${data.aws_caller_identity.current.account_id}:trail/${aws_cloudtrail.all-events.name}"
-        },
-        StringLike : {
-          "kms:EncryptionContext:aws:cloudtrail:arn" : "arn:aws:cloudtrail:*:${data.aws_caller_identity.current.account_id}:trail/*"
-        }
-      }
-    }]
-  })
 }
diff --git a/infrastructure/kms.tf b/infrastructure/kms.tf
@@ -131,6 +131,32 @@ resource "aws_kms_key" "key" {
           }
         }
       },
+      {
+        Sid : "Allow CloudTrail to encrypt logs",
+        Effect : "Allow",
+        Principal : {
+          Service : "cloudtrail.amazonaws.com"
+        },
+        Action : "kms:GenerateDataKey*",
+        Resource : "*",
+        Condition : {
+          StringEquals : {
+            "aws:SourceArn" : "arn:aws:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/${var.cloudtrail_name}"
+          },
+          StringLike : {
+            "kms:EncryptionContext:aws:cloudtrail:arn" : "arn:aws:cloudtrail:*:${data.aws_caller_identity.current.account_id}:trail/*"
+          }
+        }
+      },
+      {
+        "Sid" : "Allow CloudTrail to decrypt a trail",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "cloudtrail.amazonaws.com"
+        },
+        "Action" : "kms:Decrypt",
+        "Resource" : "*"
+      },
       {
         Sid : "Allow CloudTrail access",
         Effect : "Allow",