add missing kms permissions related to s3 (#8)

Author: kldavis4

aws/terraform/modules/metaflow/iam.tf

@@ -61,14 +61,10 @@ data "aws_iam_policy_document" "s3_kms" {
   statement {
     effect = "Allow"
 
-    # TODO - reduce to Encrypt, Decrypt?
     actions = [
       "kms:Decrypt",
       "kms:Encrypt",
-      # "kms:ReEncryptTo",
-      # "kms:ReEncryptFrom",
-      # "kms:DescribeKey",
-      # "kms:GenerateDataKey"
+      "kms:GenerateDataKey"
     ]
 
     resources = [
@@ -224,6 +220,12 @@ resource "aws_iam_role_policy" "grant_custom_s3_batch" {
   policy = data.aws_iam_policy_document.custom_s3_batch.json
 }
 
+resource "aws_iam_role_policy" "grant_s3_kms" {
+  name   = "s3_kms"
+  role   = aws_iam_role.batch_s3_task_role.name
+  policy = data.aws_iam_policy_document.s3_kms.json
+}
+
 resource "aws_iam_role_policy" "grant_deny_presigned_batch" {
   name   = "deny_presigned"
   role   = aws_iam_role.batch_s3_task_role.name

aws/terraform/modules/metaflow/modules/metadata-service/iam.tf

@@ -31,6 +31,7 @@ data "aws_iam_policy_document" "s3_kms" {
     actions = [
       "kms:Decrypt",
       "kms:Encrypt",
+      "kms:GenerateDataKey"
     ]
 
     resources = [