Skip to content

fix: condition on the creation of the kms key #1286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix: condition on the creation of the kms key #1286

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0a3c754
fix: condition on the creation of the kms key
schniber Jun 5, 2025
1c2d7da
fix: condition on the creation of the kms key
schniber Jun 6, 2025
8bca1ba
Merge branch 'main' into main
schniber Jun 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,6 +388,7 @@ module "terminate_agent_hook" {
name_iam_objects = local.name_iam_objects
name_docker_machine_runners = local.runner_tags_merged["Name"]
role_permissions_boundary = var.iam_permissions_boundary == "" ? null : "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/${var.iam_permissions_boundary}"
enable_managed_kms_key = var.enable_managed_kms_key
kms_key_id = local.kms_key_arn
asg_hook_terminating_heartbeat_timeout = local.runner_worker_graceful_terminate_heartbeat_timeout
environment_variables = var.runner_terminate_ec2_environment_variables
Expand Down
7 changes: 4 additions & 3 deletions modules/terminate-agent-hook/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,14 @@ resource "aws_iam_role" "lambda" {
}

resource "aws_iam_role_policy_attachment" "lambda_kms" {
count = var.kms_key_id != "" ? 1 : 0
count = !var.enable_managed_kms_key ? 1 : 0

role = aws_iam_role.lambda.name
policy_arn = aws_iam_policy.lambda_kms[0].arn
}

resource "aws_iam_policy" "lambda_kms" {
count = var.kms_key_id != "" ? 1 : 0
count = !var.enable_managed_kms_key ? 1 : 0

name = "${var.name_iam_objects}-${var.name}-lambda-kms"
path = "/"
Expand All @@ -50,7 +50,7 @@ resource "aws_iam_policy" "lambda_kms" {
}

data "aws_iam_policy_document" "kms_key" {
count = var.kms_key_id != "" ? 1 : 0
count = !var.enable_managed_kms_key ? 1 : 0

# checkov:skip=CKV_AWS_111:Write access is limited to the resources needed
statement {
Expand Down Expand Up @@ -190,4 +190,5 @@ resource "aws_iam_role_policy_attachment" "spot_request_housekeeping" {
resource "aws_iam_role_policy_attachment" "aws_lambda_vpc_access_execution_role" {
role = aws_iam_role.lambda.name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"

}
6 changes: 6 additions & 0 deletions modules/terminate-agent-hook/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,12 @@ variable "name_docker_machine_runners" {
type = string
}

variable "enable_managed_kms_key" {
description = "Let the module manage a KMS key. Be-aware of the costs of an custom key. Do not specify a `kms_key_id` when `enable_kms` is set to `true`."
type = bool
default = false
}

variable "kms_key_id" {
description = "(optional) KMS key id to encrypt the resources, e.g. logs, lambda environment variables, ..."
type = string
Expand Down