Always grant deployer access to KMS key

Author: aarongorka

cloudtrail.tf

@@ -42,6 +42,12 @@ resource "aws_kms_alias" "cloudtrail" {
   target_key_id = "${aws_kms_key.cloudtrail.key_id}"
 }
 
+# KMS requires that the creator has access to the key so you don't lock yourself out
+locals {
+  my_role_name = "${split("/", data.aws_caller_identity.master.arn)[1]}"
+  my_role_arn  = "arn:aws:iam::${data.aws_caller_identity.master.account_id}:role/${local.my_role_name}"
+}
+
 resource "aws_kms_key" "cloudtrail" {
   provider = aws.master
 
@@ -55,7 +61,8 @@ resource "aws_kms_key" "cloudtrail" {
       "Effect": "Allow",
       "Principal": {
         "AWS": [
-          "arn:aws:iam::${data.aws_caller_identity.master.account_id}:role/${var.client_name}-role-console-breakglass"
+          "arn:aws:iam::${data.aws_caller_identity.master.account_id}:role/${var.client_name}-role-console-breakglass",
+          "${local.my_role_arn}"
         ]
       },
       "Action": [