NRL-693 add kms key encryption for sns topic

Author: eesa456

terraform/account-wide-infrastructure/modules/lambda-errors-metric-alarm/iam.tf

@@ -0,0 +1,21 @@
+resource "aws_iam_policy" "lambda-errors-topic-kms-read-write" {
+  name        = "${var.name_prefix}-lambda-errors-topic-kms-read-write"
+  description = "Encrypt and decrypt with the lambda errors sns topic kms key"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "kms:Decrypt",
+          "kms:DescribeKey",
+          "kms:Encrypt",
+          "kms:GenerateDataKey"
+        ]
+        Effect = "Allow"
+        Resource = [
+          aws_kms_key.lambda-errors-topic-key.arn
+        ]
+      }
+    ]
+  })
+}

terraform/account-wide-infrastructure/modules/lambda-errors-metric-alarm/kms.tf

@@ -0,0 +1,10 @@
+resource "aws_kms_key" "lambda-errors-topic-key" {
+  description             = "Lambda errors SNS topic table KMS key"
+  deletion_window_in_days = var.kms_deletion_window_in_days
+
+}
+
+resource "aws_kms_alias" "lambda-errors-topic-alias" {
+  name          = "alias/${var.name_prefix}-lambda-errors-topic-table-key"
+  target_key_id = aws_kms_key.lambda-errors-topic-key.key_id
+}

terraform/account-wide-infrastructure/modules/lambda-errors-metric-alarm/sns.tf

@@ -1,10 +1,11 @@
 resource "aws_sns_topic" "sns_topic" {
-  name = "${var.name_prefix}--lambda-errors-sns-topic"
+  name              = "${var.name_prefix}--lambda-errors-sns-topic"
+  kms_master_key_id = aws_kms_key.lambda-errors-topic-key.key_id
 }
 
 resource "aws_sns_topic_subscription" "sns_subscription" {
-  for_each  = toset(data.aws_secretsmanager_secret_version.emails.secret_string)
+  for_each  = nonsensitive(toset(tolist(jsondecode(data.aws_secretsmanager_secret_version.emails.secret_string))))
   topic_arn = aws_sns_topic.sns_topic.arn
   protocol  = "email"
-  endpoint  = each.value
+  endpoint  = sensitive(each.value)
 }

terraform/account-wide-infrastructure/modules/lambda-errors-metric-alarm/vars.tf

@@ -54,3 +54,9 @@ variable "name_prefix" {
   type        = string
   description = "The prefix to apply to all resources in the module."
 }
+
+variable "kms_deletion_window_in_days" {
+  type        = number
+  description = "The duration in days after which the key is deleted after destruction of the resource."
+  default     = 7
+}