fix kms usecase on init (#333)

Author: iakov-aws

data-collection/deploy/deploy-data-collection.yaml

@@ -1,6 +1,6 @@
 # https://github.com/awslabs/cid-data-collection-framework/blob/main/data-collection/deploy/deploy-data-collection.yaml
 AWSTemplateFormatVersion: '2010-09-09'
-Description: CID Data Collection Stack v3.9.0 - AWS Solution SO9011
+Description: CID Data Collection Stack v3.9.1 - AWS Solution SO9011
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:
@@ -596,6 +596,17 @@ Resources:
                   - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog"
                   - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${DatabaseName}"
                   - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${DatabaseName}/*"
+        - !If
+          - NeedDataBucketsKms
+          - PolicyName: "KMS"
+            PolicyDocument:
+              Version: "2012-10-17"
+              Statement:
+                - Effect: "Allow"
+                  Action:
+                    - "kms:Decrypt"
+                  Resource: !Split [ ',', !Ref DataBucketsKmsKeysArns ]
+          - !Ref AWS::NoValue
 
   KmsPolicyForCidResources:
     Type: AWS::IAM::Policy
@@ -610,7 +621,6 @@ Resources:
               - 'kms:Decrypt'
             Resource: !Split [ ',', !Ref DataBucketsKmsKeysArns ]
       Roles:
-        - !Ref LambdaInitRole
         - !Ref StepFunctionExecutionRole
         - !Ref LambdaManageGlueTableRole
         - !Ref GlueRole

data-collection/deploy/deploy-data-read-permissions.yaml

@@ -1,6 +1,6 @@
 # https://github.com/awslabs/cid-data-collection-framework/blob/main/data-collection/deploy/deploy-data-read-permissions.yaml
 AWSTemplateFormatVersion: '2010-09-09'
-Description: CID Data Collection - All-in-One for Management Account v3.9.0 - AWS Solution SO9011
+Description: CID Data Collection - All-in-One for Management Account v3.9.1 - AWS Solution SO9011
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:
@@ -223,7 +223,7 @@ Resources:
   DataCollectorOrgAccountModulesReadStackSet:
     Type: AWS::CloudFormation::StackSet
     Properties:
-      Description: "StackSet in charge of deploying read roles across organization accounts v3.9.0"
+      Description: "StackSet in charge of deploying read roles across organization accounts v3.9.1"
       PermissionModel: SERVICE_MANAGED
       AutoDeployment:
         Enabled: true

data-collection/deploy/deploy-in-linked-account.yaml

@@ -1,5 +1,5 @@
 AWSTemplateFormatVersion: '2010-09-09'
-Description: CID Data Collection - Role for Linked Account v3.9.0
+Description: CID Data Collection - Role for Linked Account v3.9.1
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:

data-collection/deploy/deploy-in-management-account.yaml

@@ -1,5 +1,5 @@
 AWSTemplateFormatVersion: '2010-09-09'
-Description: CID Data Collection - Role for Management Account v3.9.0
+Description: CID Data Collection - Role for Management Account v3.9.1
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:

data-collection/utils/version.json

@@ -1,3 +1,3 @@
 {
-    "version": "3.9.0"
+    "version": "3.9.1"
 }