Add GitHub Actions role to KMS key policy principals

ben-vaughan-nttd · ben-vaughan-nttd · commit e4810ed4871a · 2025-11-25T11:10:40.000-06:00
diff --git a/examples/simple/main.tf b/examples/simple/main.tf
@@ -29,7 +29,7 @@ locals {
       ]
       resources = ["arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"]
       principals = {
-        "AWS" = tolist(data.aws_iam_roles.administrator_access.arns)
+        "AWS" = concat(tolist(data.aws_iam_roles.administrator_access.arns), ["arn:aws:iam::020127659860:role/github-actions-deploy-role-terraform"])
       }
     }
   }
diff --git a/examples/with_condition/main.tf b/examples/with_condition/main.tf
@@ -36,7 +36,7 @@ locals {
       ]
       resources = ["arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"]
       principals = {
-        "AWS" = tolist(data.aws_iam_roles.administrator_access.arns)
+        "AWS" = concat(tolist(data.aws_iam_roles.administrator_access.arns), ["arn:aws:iam::020127659860:role/github-actions-deploy-role-terraform"])
       }
       condition = [
         {

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,7 @@ locals {`
`29`	`29`	`]`
`30`	`30`	`resources = ["arn:aws:kms::${data.aws_caller_identity.current.account_id}:key/"]`
`31`	`31`	`principals = {`
`32`		`- "AWS" = tolist(data.aws_iam_roles.administrator_access.arns)`
	`32`	`+ "AWS" = concat(tolist(data.aws_iam_roles.administrator_access.arns), ["arn:aws:iam::020127659860:role/github-actions-deploy-role-terraform"])`
`33`	`33`	`}`
`34`	`34`	`}`
`35`	`35`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ locals {`
`36`	`36`	`]`
`37`	`37`	`resources = ["arn:aws:kms::${data.aws_caller_identity.current.account_id}:key/"]`
`38`	`38`	`principals = {`
`39`		`- "AWS" = tolist(data.aws_iam_roles.administrator_access.arns)`
	`39`	`+ "AWS" = concat(tolist(data.aws_iam_roles.administrator_access.arns), ["arn:aws:iam::020127659860:role/github-actions-deploy-role-terraform"])`
`40`	`40`	`}`
`41`	`41`	`condition = [`
`42`	`42`	`{`