feat(etl-ods): FTRS-3181 use newly created CMK with the etl scheduler

Author: mabe13

infrastructure/stacks/etl_ods/data.tf

@@ -156,17 +156,6 @@ data "aws_iam_policy_document" "ods_etl_scheduler_invoke_policy" {
       module.extractor_lambda.lambda_function_arn
     ]
   }
-
-  statement {
-    effect = "Allow"
-    actions = [
-      "kms:Decrypt",
-      "kms:DescribeKey",
-      "kms:CreateGrant",
-      "kms:ReEncrypt"
-    ]
-    resources = [data.aws_kms_key.scheduler_kms_key.arn]
-  }
 }
 
 data "aws_kms_key" "sqs_kms_alias" {

infrastructure/stacks/etl_ods/iam.tf

@@ -11,6 +11,19 @@ resource "aws_iam_role" "ods_etl_scheduler_invoke_role" {
           Service = "scheduler.amazonaws.com"
         }
         Action = "sts:AssumeRole"
+      },
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "s3.amazonaws.com"
+        },
+        Actions = [
+          "kms:Decrypt",
+          "kms:DescribeKey",
+          "kms:CreateGrant",
+          "kms:ReEncrypt"
+        ]
+        resources = [data.aws_kms_key.scheduler_kms_key.arn]
       }
     ]
   })