CCM-9051: delete ddb key

alexnuttall · alexnuttall · commit e2831804a39d · 2025-06-03T16:13:15.000+01:00
diff --git a/infrastructure/terraform/components/sandbox/module_backend_api.tf b/infrastructure/terraform/components/sandbox/module_backend_api.tf
@@ -21,7 +21,6 @@ module "backend_api" {
   letter_suppliers = var.letter_suppliers
 
   kms_key_arn          = data.aws_kms_key.sandbox.arn
-  dynamodb_kms_key_arn = data.aws_kms_key.sandbox.arn
 
   send_to_firehose = false
 }
diff --git a/infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf b/infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf
@@ -26,7 +26,7 @@ resource "aws_dynamodb_table" "templates" {
 
   server_side_encryption {
     enabled     = true
-    kms_key_arn = local.dynamodb_kms_key_arn
+    kms_key_arn = var.kms_key_arn
   }
 
   tags = {
diff --git a/infrastructure/terraform/modules/backend-api/kms_key_dynamo.tf b/infrastructure/terraform/modules/backend-api/kms_key_dynamo.tf
diff --git a/infrastructure/terraform/modules/backend-api/locals.tf b/infrastructure/terraform/modules/backend-api/locals.tf
@@ -50,8 +50,6 @@ locals {
     ENABLE_PROOFING                  = var.enable_proofing
   }
 
-  dynamodb_kms_key_arn = var.dynamodb_kms_key_arn == "" ? aws_kms_key.dynamo[0].arn : var.dynamodb_kms_key_arn
-
   mock_letter_supplier_name = "WTMMOCK"
 
   use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null
diff --git a/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf
@@ -62,7 +62,6 @@ data "aws_iam_policy_document" "create_letter_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn,
       var.kms_key_arn
     ]
   }
diff --git a/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "create_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "delete_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "get_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf
@@ -76,7 +76,7 @@ data "aws_iam_policy_document" "process_proof" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn,
+      var.kms_key_arn,
     ]
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf
@@ -74,7 +74,7 @@ data "aws_iam_policy_document" "request_proof_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf
@@ -124,7 +124,7 @@ data "aws_iam_policy_document" "send_letter_proof" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf b/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf
@@ -64,7 +64,7 @@ data "aws_iam_policy_document" "set_file_virus_scan_status_for_upload" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn,
+      var.kms_key_arn
     ]
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf b/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf
@@ -64,23 +64,6 @@ data "aws_iam_policy_document" "validate_letter_template_files" {
     ]
   }
 
-  statement {
-    sid    = "AllowKMSAccessDynamo"
-    effect = "Allow"
-
-    actions = [
-      "kms:Decrypt",
-      "kms:DescribeKey",
-      "kms:Encrypt",
-      "kms:GenerateDataKey*",
-      "kms:ReEncrypt*",
-    ]
-
-    resources = [
-      local.dynamodb_kms_key_arn
-    ]
-  }
-
   statement {
     sid    = "AllowS3InternalGetObject"
     effect = "Allow"
@@ -120,12 +103,15 @@ data "aws_iam_policy_document" "validate_letter_template_files" {
   }
 
   statement {
-    sid    = "AllowKMSAccessS3SQS"
+    sid    = "AllowKMSAccess"
     effect = "Allow"
 
     actions = [
       "kms:Decrypt",
+      "kms:DescribeKey",
+      "kms:Encrypt",
       "kms:GenerateDataKey",
+      "kms:ReEncrypt*",
     ]
 
     resources = [
diff --git a/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "list_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "submit_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf
@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "update_template_lambda_policy" {
     ]
 
     resources = [
-      local.dynamodb_kms_key_arn
+      var.kms_key_arn
     ]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/variables.tf b/infrastructure/terraform/modules/backend-api/variables.tf
@@ -81,12 +81,6 @@ variable "kms_key_arn" {
   description = "KMS Key ARN"
 }
 
-variable "dynamodb_kms_key_arn" {
-  type        = string
-  description = "KMS Key ARN for encrypting DynamoDB data. If not given, a key will be created."
-  default     = ""
-}
-
 variable "letter_suppliers" {
   type = map(object({
     enable_polling   = bool

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,6 @@ module "backend_api" {`
`21`	`21`	`letter_suppliers = var.letter_suppliers`
`22`	`22`
`23`	`23`	`kms_key_arn = data.aws_kms_key.sandbox.arn`
`24`		`- dynamodb_kms_key_arn = data.aws_kms_key.sandbox.arn`
`25`	`24`
`26`	`25`	`send_to_firehose = false`
`27`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ resource "aws_dynamodb_table" "templates" {`
`26`	`26`
`27`	`27`	`server_side_encryption {`
`28`	`28`	`enabled = true`
`29`		`- kms_key_arn = local.dynamodb_kms_key_arn`
	`29`	`+ kms_key_arn = var.kms_key_arn`
`30`	`30`	`}`
`31`	`31`
`32`	`32`	`tags = {`
Original file line number	Diff line number	Diff line change
`@@ -50,8 +50,6 @@ locals {`
`50`	`50`	`ENABLE_PROOFING = var.enable_proofing`
`51`	`51`	`}`
`52`	`52`
`53`		`- dynamodb_kms_key_arn = var.dynamodb_kms_key_arn == "" ? aws_kms_key.dynamo[0].arn : var.dynamodb_kms_key_arn`
`54`		`-`
`55`	`53`	`mock_letter_supplier_name = "WTMMOCK"`
`56`	`54`
`57`	`55`	`use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null`
Original file line number	Diff line number	Diff line change
`@@ -62,7 +62,6 @@ data "aws_iam_policy_document" "create_letter_template_lambda_policy" {`
`62`	`62`	`]`
`63`	`63`
`64`	`64`	`resources = [`
`65`		`- local.dynamodb_kms_key_arn,`
`66`	`65`	`var.kms_key_arn`
`67`	`66`	`]`
`68`	`67`	`}`
Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "create_template_lambda_policy" {`
`61`	`61`	`]`
`62`	`62`
`63`	`63`	`resources = [`
`64`		`- local.dynamodb_kms_key_arn`
	`64`	`+ var.kms_key_arn`
`65`	`65`	`]`
`66`	`66`	`}`
`67`	`67`	`}`
Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,7 @@ data "aws_iam_policy_document" "process_proof" {`
`76`	`76`	`]`
`77`	`77`
`78`	`78`	`resources = [`
`79`		`- local.dynamodb_kms_key_arn,`
	`79`	`+ var.kms_key_arn,`
`80`	`80`	`]`
`81`	`81`	`}`
`82`	`82`
Original file line number	Diff line number	Diff line change
`@@ -74,7 +74,7 @@ data "aws_iam_policy_document" "request_proof_lambda_policy" {`
`74`	`74`	`]`
`75`	`75`
`76`	`76`	`resources = [`
`77`		`- local.dynamodb_kms_key_arn`
	`77`	`+ var.kms_key_arn`
`78`	`78`	`]`
`79`	`79`	`}`
`80`	`80`