key policy changes

Author: alexnuttall

infrastructure/terraform/components/acct/module_sandbox_kms.tf

@@ -103,9 +103,15 @@ data "aws_iam_policy_document" "kms" {
     resources = ["*"]
 
     condition {
-      test     = "StringEquals"
+      test     = "ArnLike"
       variable = "kms:EncryptionContext:aws:sqs:arn"
       values   = ["arn:aws:sqs:${var.region}:${var.aws_account_id}:*-validate-letter-template-files-queue"]
     }
+
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+      values   = ["arn:aws:events:${var.region}:${var.aws_account_id}:rule/*-quarantine-scan-passed-for-upload"]
+    }
   }
 }

infrastructure/terraform/components/app/module_kms.tf

@@ -124,16 +124,18 @@ data "aws_iam_policy_document" "kms" {
     resources = ["*"]
 
     condition {
-      test     = "StringEquals"
-      variable = "kms:ViaService"
-      values   = ["sqs.${var.region}.amazonaws.com"]
+      test     = "ArnEquals"
+      variable = "kms:EncryptionContext:aws:sqs:arn"
+      values = [
+        module.backend_api.letter_file_validation_queue_arn
+      ]
     }
 
     condition {
-      test     = "StringEquals"
-      variable = "kms:EncryptionContext:aws:sqs:arn"
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
       values = [
-        module.sqs_validate_letter_template_files.sqs_queue_arn
+        module.backend_api.upload_scan_passed_rule_arn
       ]
     }
   }

infrastructure/terraform/modules/backend-api/outputs.tf

@@ -38,3 +38,11 @@ output "quarantine_bucket_name" {
   value = module.s3bucket_quarantine.id
 }
 
+output "upload_scan_passed_rule_arn" {
+  value = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_for_upload.arn
+}
+
+output "letter_file_validation_queue_arn" {
+  value = module.sqs_validate_letter_template_files.sqs_queue_arn
+}
+