feat(etl-ods): FTRS-3181 use newly created CMK with the etl scheduler

mabe13 · mabe13 · commit a6c44028911f · 2026-02-20T11:56:44.000Z
diff --git a/infrastructure/stacks/etl_ods/data.tf b/infrastructure/stacks/etl_ods/data.tf
@@ -162,7 +162,8 @@ data "aws_iam_policy_document" "ods_etl_scheduler_invoke_policy" {
     actions = [
       "kms:Decrypt",
       "kms:DescribeKey",
-      "kms:GenerateDataKey*"
+      "kms:CreateGrant",
+      "kms:ReEncrypt"
     ]
     resources = [data.aws_kms_key.scheduler_kms_key.arn]
   }

Original file line number	Diff line number	Diff line change
`@@ -162,7 +162,8 @@ data "aws_iam_policy_document" "ods_etl_scheduler_invoke_policy" {`
`162`	`162`	`actions = [`
`163`	`163`	`"kms:Decrypt",`
`164`	`164`	`"kms:DescribeKey",`
`165`		`- "kms:GenerateDataKey*"`
	`165`	`+ "kms:CreateGrant",`
	`166`	`+ "kms:ReEncrypt"`
`166`	`167`	`]`
`167`	`168`	`resources = [data.aws_kms_key.scheduler_kms_key.arn]`
`168`	`169`	`}`