kms:decrypt

Author: nhsdevws

terraform/id_sync_lambda.tf

@@ -224,7 +224,15 @@ resource "aws_iam_policy" "id_sync_lambda_kms_access_policy" {
         Resource = [
           data.aws_kms_key.existing_s3_encryption_key.arn,
         ]
-      }
+      },
+	  {
+		Effect = "Allow"
+		Action = [
+		  "kms:Decrypt",
+		  "kms:GenerateDataKey*"
+		]
+		Resource = data.aws_kms_key.existing_dynamo_encryption_key.arn
+	  }
     ]
   })
 }