module.yml

---
# Copyright 2019 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: AWS KMS key (strict)'
# cfn-modules:implements(ExposeArn, LambdaDependency)
Parameters:
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  AdminAccess:
    Description: 'Comma-delimited list of IAM principals (e.g., IAM Role or User ARN) allowed to administer this CMK.'
    Type: String
  UseAccess:
    Description: 'Optional comma-delimited list of IAM principals (e.g., IAM Role or User ARN) allowed to use this CMK.'
    Type: String
    Default: ''
  ServiceAccess:
    Description: 'Which AWS service is allowed to use this CMK from the same AWS account and region?'
    Type: String
    Default: 'NO_SERVICES'
    AllowedValues: ['NO_SERVICES', 'ALL_SERVICES', connect, dms, ssm, ec2, elasticfilesystem, es, kinesis, kinesisvideo, lambda, lex, redshift, rds, secretsmanager, ses, s3, importexport, sqs, workmail, workspaces]
  AliasName:
    Description: 'Optional alias name (if not set, the stack name is used).'
    Type: String
    Default: ''
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasUseAccess: !Not [!Equals [!Ref UseAccess, '']]
  HasServiceAccessAllServices: !Equals [!Ref ServiceAccess, 'ALL_SERVICES']
  HasServiceAccessNoServices: !Equals [!Ref ServiceAccess, 'NO_SERVICES']
  HasAliasName: !Not [!Equals [!Ref AliasName, '']]
Resources:
  Alias:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: 'AWS::KMS::Alias'
    Properties:
      AliasName: !If [HasAliasName, !Sub 'alias/${AliasName}', !Sub 'alias/${AWS::StackName}']
      TargetKeyId: !Ref Key
  Key:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: 'AWS::KMS::Key'
    Properties:
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow # allow all IAM entities from same account to read the CMK configuratio
          Principal:
            AWS: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:root'
          Action:
          - 'kms:Describe*'
          - 'kms:Get*'
          - 'kms:List*'
          Resource: '*'
        - Effect: Allow
          Principal:
            AWS: !Split [',', !Ref AdminAccess]
          Action:
          - 'kms:*'
          Resource: '*'
        - !If
          - HasUseAccess
          - Effect: Allow
            Principal:
              AWS: !Split [',', !Ref UseAccess]
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:RevokeGrant'
            - 'kms:Describe*'
            - 'kms:Get*'
            - 'kms:List*'
            Resource: '*'
          - !Ref 'AWS::NoValue'
        - !If
          - HasServiceAccessNoServices
          - !Ref 'AWS::NoValue'
          - Effect: Allow
            Principal:
              AWS: '*'
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:ListGrants'
            - 'kms:DescribeKey'
            Resource: '*'
            Condition:
              StringEquals:
                'kms:CallerAccount': !Ref 'AWS::AccountId'
              StringLike:
                'kms:ViaService': !If [HasServiceAccessAllServices, !Sub '*.${AWS::Region}.amazonaws.com', !Sub '${ServiceAccess}.${AWS::Region}.amazonaws.com']
  Rule:
    Condition: HasAlertingModule
    Type: 'AWS::Events::Rule'
    Properties:
      EventPattern:
        source:
        - 'aws.kms'
        'detail-type':
        - 'AWS API Call via CloudTrail'
        resources:
        - !GetAtt Key.Arn
        detail:
          eventSource:
          - 'kms.amazonaws.com'
          'eventName':
          - ScheduleKeyDeletion
          - DisableKey
      State: ENABLED
      Targets:
      - Arn: {'Fn::ImportValue': !Sub '${AlertingModule}-Arn'}
        Id: rule
Outputs:
  ModuleId:
    Value: 'kms-key-strict'
  ModuleVersion:
    Value: '0.2.1'
  StackName:
    Value: !Ref 'AWS::StackName'
  Arn:
    Value: !GetAtt Key.Arn
    Export:
      Name: !Sub '${AWS::StackName}-Arn'
  IamActions:
    Value: 'kms:Encrypt,kms:Decrypt,kms:ReEncrypt*,kms:GenerateDataKey*,kms:DescribeKey'
    Export:
      Name: !Sub '${AWS::StackName}-IamActions'
  IamResources:
    Value: !GetAtt Key.Arn
    Export:
      Name: !Sub '${AWS::StackName}-IamResources'