CCM-9051: remove legacy KMS key (#507)

alexnuttall · web-flow · commit d27fe0c59a96 · 2025-06-05T08:53:44.000+01:00
diff --git a/infrastructure/terraform/components/sandbox/module_backend_api.tf b/infrastructure/terraform/components/sandbox/module_backend_api.tf
@@ -21,7 +21,6 @@ module "backend_api" {
   letter_suppliers = var.letter_suppliers
 
   kms_key_arn          = data.aws_kms_key.sandbox.arn
-  dynamodb_kms_key_arn = data.aws_kms_key.sandbox.arn
 
   send_to_firehose = false
 }
diff --git a/infrastructure/terraform/modules/backend-api/README.md b/infrastructure/terraform/modules/backend-api/README.md
@@ -14,7 +14,6 @@ No requirements.
 | <a name="input_cognito_config"></a> [cognito\_config](#input\_cognito\_config) | Cognito config | <pre>object({<br/>    USER_POOL_ID : string,<br/>    USER_POOL_CLIENT_ID : string<br/>  })</pre> | n/a | yes |
 | <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | n/a | yes |
 | <a name="input_csi"></a> [csi](#input\_csi) | CSI from the parent component | `string` | n/a | yes |
-| <a name="input_dynamodb_kms_key_arn"></a> [dynamodb\_kms\_key\_arn](#input\_dynamodb\_kms\_key\_arn) | KMS Key ARN for encrypting DynamoDB data. If not given, a key will be created. | `string` | `""` | no |
 | <a name="input_enable_backup"></a> [enable\_backup](#input\_enable\_backup) | Enable Backups for the DynamoDB table? | `bool` | `true` | no |
 | <a name="input_enable_proofing"></a> [enable\_proofing](#input\_enable\_proofing) | Enable proofing feature flag | `bool` | n/a | yes |
 | <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
diff --git a/infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf b/infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf
@@ -26,7 +26,7 @@ resource "aws_dynamodb_table" "templates" {
 
   server_side_encryption {
     enabled     = true
-    kms_key_arn = local.dynamodb_kms_key_arn
+    kms_key_arn = var.kms_key_arn
   }
 
   tags = {
diff --git a/infrastructure/terraform/modules/backend-api/kms_key_dynamo.tf b/infrastructure/terraform/modules/backend-api/kms_key_dynamo.tf
diff --git a/infrastructure/terraform/modules/backend-api/locals.tf b/infrastructure/terraform/modules/backend-api/locals.tf
@@ -50,8 +50,6 @@ locals {
     ENABLE_PROOFING                  = var.enable_proofing
   }
 
-  dynamodb_kms_key_arn = var.dynamodb_kms_key_arn == "" ? aws_kms_key.dynamo[0].arn : var.dynamodb_kms_key_arn
-
   mock_letter_supplier_name = "WTMMOCK"
 
   use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null
diff --git a/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf
@@ -62,7 +62,6 @@ data "aws_iam_policy_document" "create_letter_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn,
       var.kms_key_arn
     ]
   }
diff --git a/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "create_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "delete_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "get_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf
@@ -64,7 +64,7 @@ data "aws_iam_policy_document" "process_proof" {
   }
 
   statement {
-    sid    = "AllowKMSAccessDynamoDB"
+    sid    = "AllowKMSAccess"
     effect = "Allow"
 
     actions = [
@@ -75,20 +75,6 @@ data "aws_iam_policy_document" "process_proof" {
       "kms:ReEncrypt*",
     ]
 
-    resources = [
-      local.dynamodb_kms_key_arn,
-    ]
-  }
-
-  statement {
-    sid    = "AllowKMSAccessSQSDLQ"
-    effect = "Allow"
-
-    actions = [
-      "kms:Decrypt",
-      "kms:GenerateDataKey",
-    ]
-
     resources = [
       var.kms_key_arn,
     ]
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf
@@ -62,7 +62,7 @@ data "aws_iam_policy_document" "request_proof_lambda_policy" {
   }
 
   statement {
-    sid    = "AllowDdbKMSAccess"
+    sid    = "AllowKMSAccess"
     effect = "Allow"
 
     actions = [
@@ -74,21 +74,7 @@ data "aws_iam_policy_document" "request_proof_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
-    ]
-  }
-
-  statement {
-    sid    = "AllowSqsKMSAccess"
-    effect = "Allow"
-
-    actions = [
-      "kms:Decrypt",
-      "kms:GenerateDataKey",
-    ]
-
-    resources = [
-      var.kms_key_arn,
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf
@@ -124,7 +124,7 @@ data "aws_iam_policy_document" "send_letter_proof" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf b/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf
@@ -64,21 +64,7 @@ data "aws_iam_policy_document" "set_file_virus_scan_status_for_upload" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn,
-    ]
-  }
-
-  statement {
-    sid    = "AllowKMSAccessSQSDLQ"
-    effect = "Allow"
-
-    actions = [
-      "kms:Decrypt",
-      "kms:GenerateDataKey",
-    ]
-
-    resources = [
-      var.kms_key_arn,
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf b/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf
@@ -64,23 +64,6 @@ data "aws_iam_policy_document" "validate_letter_template_files" {
     ]
   }
 
-  statement {
-    sid    = "AllowKMSAccessDynamo"
-    effect = "Allow"
-
-    actions = [
-      "kms:Decrypt",
-      "kms:DescribeKey",
-      "kms:Encrypt",
-      "kms:GenerateDataKey*",
-      "kms:ReEncrypt*",
-    ]
-
-    resources = [
-      local.dynamodb_kms_key_arn
-    ]
-  }
-
   statement {
     sid    = "AllowS3InternalGetObject"
     effect = "Allow"
@@ -120,12 +103,15 @@ data "aws_iam_policy_document" "validate_letter_template_files" {
   }
 
   statement {
-    sid    = "AllowKMSAccessS3SQS"
+    sid    = "AllowKMSAccess"
     effect = "Allow"
 
     actions = [
       "kms:Decrypt",
+      "kms:DescribeKey",
+      "kms:Encrypt",
       "kms:GenerateDataKey",
+      "kms:ReEncrypt*",
     ]
 
     resources = [
diff --git a/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "list_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "submit_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "update_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/variables.tf b/infrastructure/terraform/modules/backend-api/variables.tf
@@ -81,12 +81,6 @@ variable "kms_key_arn" {
   description = "KMS Key ARN"
 }
 
-variable "dynamodb_kms_key_arn" {
-  type        = string
-  description = "KMS Key ARN for encrypting DynamoDB data. If not given, a key will be created."
-  default     = ""
-}
-
 variable "letter_suppliers" {
   type = map(object({
     enable_polling   = bool

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,6 @@ module "backend_api" {`
`21`	`21`	`letter_suppliers = var.letter_suppliers`
`22`	`22`
`23`	`23`	`kms_key_arn = data.aws_kms_key.sandbox.arn`
`24`		`- dynamodb_kms_key_arn = data.aws_kms_key.sandbox.arn`
`25`	`24`
`26`	`25`	`send_to_firehose = false`
`27`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ resource "aws_dynamodb_table" "templates" {`
`26`	`26`
`27`	`27`	`server_side_encryption {`
`28`	`28`	`enabled = true`
`29`		`- kms_key_arn = local.dynamodb_kms_key_arn`
	`29`	`+ kms_key_arn = var.kms_key_arn`
`30`	`30`	`}`
`31`	`31`
`32`	`32`	`tags = {`
Original file line number	Diff line number	Diff line change
`@@ -50,8 +50,6 @@ locals {`
`50`	`50`	`ENABLE_PROOFING = var.enable_proofing`
`51`	`51`	`}`
`52`	`52`
`53`		`- dynamodb_kms_key_arn = var.dynamodb_kms_key_arn == "" ? aws_kms_key.dynamo[0].arn : var.dynamodb_kms_key_arn`
`54`		`-`
`55`	`53`	`mock_letter_supplier_name = "WTMMOCK"`
`56`	`54`
`57`	`55`	`use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null`
Original file line number	Diff line number	Diff line change
`@@ -62,7 +62,6 @@ data "aws_iam_policy_document" "create_letter_template_lambda_policy" {`
`62`	`62`	`]`
`63`	`63`
`64`	`64`	`resources = [`
`65`		`- local.dynamodb_kms_key_arn,`
`66`	`65`	`var.kms_key_arn`
`67`	`66`	`]`
`68`	`67`	`}`
Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "create_template_lambda_policy" {`
`61`	`61`	`]`
`62`	`62`
`63`	`63`	`resources = [`
`64`		`- local.dynamodb_kms_key_arn`
	`64`	`+ var.kms_key_arn`
`65`	`65`	`]`
`66`	`66`	`}`
`67`	`67`	`}`