Skip to content

fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tim-thacker-nullify wants to merge 1 commit into from
Closed

fix(terraform): keep k8s-resources KMS input to the two ARN forms S3 can resolve #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions aws-integration-setup/terraform-v6/modules/k8s-resources/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,12 @@ variable "cronjob_schedule" {

variable "kms_key_arn" {
type = string
description = "The KMS key the collector encrypts its upload with (optional). This module only passes the value to the collector as NULLIFY_KMS_KEY_ARN, which S3 takes as SSEKMSKeyId, so every form S3 accepts is accepted here: a key ARN (including multi-Region key/mrk-... keys), an alias ARN, a bare key ID or alias/<name>. Any AWS partition"
description = "The KMS ARN shown on the Nullify configure page (optional): a key ARN or an alias ARN"
default = ""

validation {
condition = var.kms_key_arn == "" || can(regex("^(arn:aws[a-z-]*:kms:[a-z0-9-]+:[0-9]{12}:(key/(mrk-)?[a-f0-9-]+|alias/[A-Za-z0-9/_-]+)|mrk-[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|alias/[A-Za-z0-9/_-]+)$", var.kms_key_arn))
error_message = "Must be empty, a KMS key ARN (arn:<partition>:kms:<region>:<account-id>:key/<key-id>), a KMS alias ARN (arn:<partition>:kms:<region>:<account-id>:alias/<name>), a bare key ID or alias/<name>"
condition = var.kms_key_arn == "" || can(regex("^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:(key/(mrk-)?[a-f0-9-]+|alias/[A-Za-z0-9/_-]+)$", var.kms_key_arn))
error_message = "Must be empty, a KMS key ARN (arn:aws:kms:<region>:<account-id>:key/<key-id>) or a KMS alias ARN (arn:aws:kms:<region>:<account-id>:alias/<name>)"
}
}

Expand Down
2 changes: 1 addition & 1 deletion aws-integration-setup/terraform/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ terraform init && terraform apply

IAM ignores alias ARNs in a policy's `Resource`, so the KMS policy grants the ARN you pass and `arn:aws:kms:<region>:<account>:key/*` in the same Nullify account and region. Nullify's key policy is the real gate: the role can only use Nullify keys whose key policy allows it. The `kms_policy_resources` module output lists both resources.

`k8s-resources` takes the same variable but writes no IAM policy: it forwards the value to the collector as `NULLIFY_KMS_KEY_ARN`, which S3 takes as `SSEKMSKeyId`. It therefore accepts every form S3 does, including a bare key ID or `alias/<name>`, in any partition.
`k8s-resources` takes the same variable and writes no IAM policy: it forwards the value to the collector as `NULLIFY_KMS_KEY_ARN`, which S3 takes as `SSEKMSKeyId`. The key is in Nullify's account, and S3 resolves a bare key ID or a bare `alias/<name>` against the calling account, so only the two ARN forms above work there too. Both modules validate for them.

## Module Usage

Expand Down
6 changes: 3 additions & 3 deletions aws-integration-setup/terraform/modules/k8s-resources/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,12 @@ variable "cronjob_schedule" {

variable "kms_key_arn" {
type = string
description = "The KMS key the collector encrypts its upload with (optional). This module only passes the value to the collector as NULLIFY_KMS_KEY_ARN, which S3 takes as SSEKMSKeyId, so every form S3 accepts is accepted here: a key ARN (including multi-Region key/mrk-... keys), an alias ARN, a bare key ID or alias/<name>. Any AWS partition"
description = "The KMS ARN shown on the Nullify configure page (optional): a key ARN or an alias ARN"
default = ""

validation {
condition = var.kms_key_arn == "" || can(regex("^(arn:aws[a-z-]*:kms:[a-z0-9-]+:[0-9]{12}:(key/(mrk-)?[a-f0-9-]+|alias/[A-Za-z0-9/_-]+)|mrk-[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|alias/[A-Za-z0-9/_-]+)$", var.kms_key_arn))
error_message = "Must be empty, a KMS key ARN (arn:<partition>:kms:<region>:<account-id>:key/<key-id>), a KMS alias ARN (arn:<partition>:kms:<region>:<account-id>:alias/<name>), a bare key ID or alias/<name>"
condition = var.kms_key_arn == "" || can(regex("^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:(key/(mrk-)?[a-f0-9-]+|alias/[A-Za-z0-9/_-]+)$", var.kms_key_arn))
error_message = "Must be empty, a KMS key ARN (arn:aws:kms:<region>:<account-id>:key/<key-id>) or a KMS alias ARN (arn:aws:kms:<region>:<account-id>:alias/<name>)"
}
}

Expand Down
Loading