ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-07-24 22:00:22 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

aws_kms enhancements (#31960)

Browse source 
* Allow creation and deletion of keys (deletion just schedules for
  deletion, recreating an old key is just cancelling its deletion)
* Allow grants to be set, thus enabling encryption contexts to be
  used with keys
* Allow tags to be added and modified
* Add testing for KMS module
* Tidy up aws_kms module to latest standards
This commit is contained in:
Will Thames 2019-02-13 13:06:58 +10:00 • committed by GitHub
commit 46fbcf08bc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 1136 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

54
hacking/aws_config/testing_policies/kms-policy.json Normal file
View file

@ -0,0 +1,54 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToUnspecifiedKMSResources",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"kms:CancelKeyDeletion",
"kms:CreateAlias",
"kms:CreateGrant",
"kms:CreateKey",
"kms:DeleteAlias",
"kms:Describe*",
"kms:DisableKey",
"kms:EnableKey",
"kms:GenerateRandom",
"kms:Get*",
"kms:List*",
"kms:RetireGrant",
"kms:ScheduleKeyDeletion",
"kms:TagResource",
"kms:UntagResource",
"kms:UpdateGrant",
"kms:UpdateKeyDescription"
],
"Resource": "*"
},
{
"Sid": "AllowAccessToSpecifiedIAMResources",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:DeleteRole",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:PassRole",
"iam:UpdateAssumeRolePolicy"
],
"Resource": "arn:aws:iam::{{aws_account}}:role/ansible-test-*"
},
{
"Sid": "AllowInstanceProfileCreation",
"Effect": "Allow",
"Action": [
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:RemoveRoleFromInstanceProfile"
],
"Resource": "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-*"
}
]
}