refactor: move queue policy to sqs policy instead off ssm

Author: npalm

modules/webhook/policies/lambda-publish-sqs-policy.json

@@ -5,6 +5,16 @@
       "Effect": "Allow",
       "Action": ["sqs:SendMessage", "sqs:GetQueueAttributes"],
       "Resource": ${sqs_resource_arns}
+      %{ if kms_key_arn != "" ~}
+    },
+    {
+        "Effect": "Allow",
+        "Action": [
+            "kms:Decrypt",
+            "kms:GenerateDataKey"
+        ],
+        "Resource": "${kms_key_arn}"
+    %{ endif ~}
     }
   ]
 }

modules/webhook/policies/lambda-ssm.json

@@ -2,23 +2,13 @@
   "Version": "2012-10-17",
   "Statement": [
     {
-        "Effect": "Allow",
-        "Action": [
-            "ssm:GetParameter"
-        ],
-        "Resource": [
-            "${github_app_webhook_secret_arn}"
-        ]
-    %{ if kms_key_arn != "" ~}
-    },
-    {
-        "Effect": "Allow",
-        "Action": [
-            "kms:Decrypt",
-            "kms:GenerateDataKey"
-        ],
-        "Resource": "${kms_key_arn}"
-    %{ endif ~}
+      "Effect": "Allow",
+      "Action": [
+        "ssm:GetParameter"
+      ],
+      "Resource": [
+        "${github_app_webhook_secret_arn}"
+      ]
     }
   ]
 }

modules/webhook/webhook.tf

@@ -88,6 +88,7 @@ resource "aws_iam_role_policy" "webhook_sqs" {
 
   policy = templatefile("${path.module}/policies/lambda-publish-sqs-policy.json", {
     sqs_resource_arns = jsonencode([for k, v in var.runner_config : v.arn])
+    kms_key_arn       = var.kms_key_arn != null ? var.kms_key_arn : ""
   })
 }
 
@@ -98,6 +99,7 @@ resource "aws_iam_role_policy" "webhook_workflow_job_sqs" {
 
   policy = templatefile("${path.module}/policies/lambda-publish-sqs-policy.json", {
     sqs_resource_arns = jsonencode([var.sqs_workflow_job_queue.arn])
+    kms_key_arn       = var.kms_key_arn != null ? var.kms_key_arn : ""
   })
 }
 
@@ -107,6 +109,5 @@ resource "aws_iam_role_policy" "webhook_ssm" {
 
   policy = templatefile("${path.module}/policies/lambda-ssm.json", {
     github_app_webhook_secret_arn = var.github_app_parameters.webhook_secret.arn,
-    kms_key_arn                   = var.kms_key_arn != null ? var.kms_key_arn : ""
   })
 }