fix(topic): kms permissions (#791)

- Adds decrypt permissions to the topic permissions policy when encryption at rest is enabled
hamlet-io · Nov 30, 2023 · 284c716 · 284c716
1 parent 630c65f
commit 284c716
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/aws/components/topic/state.ftl b/aws/components/topic/state.ftl
@@ -40,7 +40,10 @@
                     "publish" : [snsPublishPermission(topicId)] +
                                 (solution.Encrypted)?then(
                                     snsEncryptionStatement(
-                                        [ "kms:GenerateDataKey*" ],
+                                        [
+                                            "kms:GenerateDataKey*",
+                                            "kms:Decrypt"
+                                        ],
                                         (baselineIds["Encryption"])!"",
                                         getExistingReference(topicId, REGION_ATTRIBUTE_TYPE)
                                     ),