fix - kms firehose permissions (#218)

Author: Karthikeyannhs

infrastructure/modules/kinesis_firehose/kms.tf

@@ -91,11 +91,24 @@ data "aws_iam_policy_document" "firehose_kms_key_policy" {
     condition {
       test     = "StringEquals"
       variable = "kms:EncryptionContext:aws:logs:arn"
-      values   = [
+      values = [
         "arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/kinesisfirehose/${var.project_name}-${var.environment}-audit"
       ]
     }
   }
+
+  statement {
+    sid    = "AllowLambdaUsage"
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [var.eligibility_lambda_role_arn]
+    }
+    actions = [
+      "kms:*"
+    ]
+    resources = [aws_kms_key.firehose_cmk.arn]
+  }
 }
 
 

infrastructure/modules/kinesis_firehose/variables.tf

@@ -23,5 +23,11 @@ variable "kinesis_cloud_watch_log_stream" {
   type        = string
 }
 
+variable "eligibility_lambda_role_arn" {
+  description = "iam role of eligibility lambda"
+  type        = any
+}
+
+
 
 

infrastructure/stacks/api-layer/kinesis_firehose.tf

@@ -9,4 +9,5 @@ module "eligibility_audit_firehose_delivery_stream" {
   tags                                = local.tags
   kinesis_cloud_watch_log_group_name  = aws_cloudwatch_log_group.firehose_audit.name
   kinesis_cloud_watch_log_stream      = aws_cloudwatch_log_stream.firehose_audit_stream.name
+  eligibility_lambda_role_arn            = aws_iam_role.eligibility_lambda_role.arn
 }