Changes to backups

Author: Valswyn-NHS

terraform_aws_backup/aws-backup-source/modules/aws_config/kms.tf

@@ -31,13 +31,4 @@ data "aws_iam_policy_document" "backup_key_policy" {
     actions   = ["kms:*"]
     resources = ["*"]
   }
-  statement {
-    sid = "AllowBackupUseOfKey"
-    principals {
-      type        = "Service"
-      identifiers = ["sns.amazonaws.com"]
-    }
-    actions   = ["kms:GenerateDataKey", "kms:Decrypt"]
-    resources = ["*"]
-  }
 }

terraform_aws_backup/aws-backup-source/modules/aws_config/sns.tf

@@ -58,6 +58,14 @@ resource "aws_kms_key" "sns_encrypt_key" {
         Action   = ["kms:GenerateDataKey*", "kms:Decrypt"]
         Resource = "*"
       },
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "backup.amazonaws.com"
+        }
+        Action   = ["kms:GenerateDataKey*", "kms:Decrypt"]
+        Resource = "*"
+      },
     ]
   })
 }