Skip to content

Commit 663e1d4

Browse files
piizamapiizama
committed
feat: add zama protocol pauser wallet module (kms key)
1 parent c0ec7b6 commit 663e1d4

File tree

4 files changed

+279
-0
lines changed

4 files changed

+279
-0
lines changed

‎modules/zama-protocol-pauser-wallet/main.tf‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# ************
2+
# Data Sources
3+
# ************
4+
data "aws_caller_identity" "current" {}
5+
6+
data "aws_eks_cluster" "cluster" {
7+
name = var.cluster_name
8+
}
9+
10+
# Create Kubernetes namespace (optional)
11+
resource "kubernetes_namespace" "zama_protocol_namespace" {
12+
count = var.k8s_create_namespace ? 1 : 0
13+
14+
metadata {
15+
name = var.k8s_namespace
16+
}
17+
}
18+
19+
# ************
20+
# Application Ethereum Key
21+
# ************
22+
data "aws_iam_policy_document" "tx_sender_policy" {
23+
statement {
24+
effect = "Allow"
25+
principals {
26+
type = "AWS"
27+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
28+
}
29+
actions = [
30+
"kms:Create*",
31+
"kms:Describe*",
32+
"kms:Enable*",
33+
"kms:List*",
34+
"kms:Put*",
35+
"kms:Update*",
36+
"kms:Revoke*",
37+
"kms:Disable*",
38+
"kms:Get*",
39+
"kms:Delete*",
40+
"kms:TagResource",
41+
"kms:UntagResource",
42+
"kms:ScheduleKeyDeletion",
43+
"kms:CancelKeyDeletion",
44+
"kms:ImportKeyMaterial",
45+
"kms:DeleteImportedKeyMaterial"
46+
]
47+
resources = ["*"]
48+
}
49+
statement {
50+
effect = "Allow"
51+
principals {
52+
type = "AWS"
53+
identifiers = [var.kms_cross_account_iam_role_arn != null ? var.kms_cross_account_iam_role_arn : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
54+
}
55+
actions = ["kms:DescribeKey", "kms:GetPublicKey", "kms:Sign", "kms:Verify"]
56+
resources = ["*"]
57+
}
58+
}
59+
60+
# ************
61+
# AWS External KMS Key for Ethereum TxSender
62+
# ************
63+
64+
resource "aws_kms_external_key" "tx_sender" {
65+
count = var.kms_use_cross_account_kms_key ? 0 : 1
66+
description = "Application ${var.app_name} tx sender key for ${var.cluster_name}"
67+
key_usage = var.kms_key_usage
68+
key_spec = var.kms_key_spec
69+
deletion_window_in_days = var.kms_deletion_window_in_days
70+
tags = var.tags
71+
policy = data.aws_iam_policy_document.tx_sender_policy.json
72+
}
73+
74+
# ************
75+
# KMS Key Alias for Application Ethereum TxSender Key
76+
# ************
77+
resource "aws_kms_alias" "tx_sender" {
78+
count = var.kms_use_cross_account_kms_key ? 0 : 1
79+
80+
name = "alias/${var.app_name}-${var.cluster_name}"
81+
target_key_id = aws_kms_external_key.tx_sender[0].id
82+
}
83+
84+
resource "aws_iam_policy" "app_kms_policy" {
85+
count = var.kms_use_cross_account_kms_key ? 0 : 1
86+
87+
name = "${var.app_name}-${var.cluster_name}"
88+
policy = jsonencode({
89+
Version = "2012-10-17"
90+
Statement = [
91+
{
92+
Sid = "AllowPauserJobToUseKeyForEthereumTxSender"
93+
Effect = "Allow",
94+
Action = [
95+
"kms:DescribeKey",
96+
"kms:GetPublicKey",
97+
"kms:Sign",
98+
"kms:Verify"
99+
],
100+
Resource = aws_kms_external_key.tx_sender[0].arn
101+
},
102+
]
103+
})
104+
}
105+
106+
module "iam_assumable_role_tx_sender" {
107+
count = var.kms_use_cross_account_kms_key && var.zama_protocol_pauser_iam_assumable_role_enabled ? 1 : 0
108+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
109+
version = "5.48.0"
110+
provider_url = data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer
111+
create_role = true
112+
role_name = "${var.app_name}-${var.cluster_name}"
113+
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.k8s_namespace}:${var.k8s_service_account_name}"]
114+
role_policy_arns = [aws_iam_policy.app_kms_policy[0].arn]
115+
}
116+
117+
resource "kubernetes_service_account" "tx_sender_irsa" {
118+
count = var.zama_protocol_pauser_iam_assumable_role_enabled && var.k8s_service_account_create ? 1 : 0
119+
metadata {
120+
name = var.k8s_service_account_name
121+
namespace = var.k8s_namespace
122+
annotations = {
123+
"eks.amazonaws.com/role-arn" = module.iam_assumable_role_tx_sender[0].iam_role_arn
124+
}
125+
}
126+
}
127+
128+
locals {
129+
kms_key_id = var.kms_use_cross_account_kms_key ? var.kms_cross_account_kms_key_id : aws_kms_external_key.tx_sender[0].id
130+
}
131+
132+
resource "kubernetes_config_map" "mpc_party_config" {
133+
count = var.k8s_config_map_create ? 1 : 0
134+
135+
metadata {
136+
name = var.k8s_config_map_name
137+
namespace = var.k8s_namespace
138+
139+
labels = {
140+
"app.kubernetes.io/name" = var.app_name
141+
"app.kubernetes.io/component" = "config"
142+
"app.kubernetes.io/managed-by" = "terraform"
143+
}
144+
145+
annotations = {
146+
"terraform.io/module" = "zama-protocol-pauser-wallet"
147+
}
148+
}
149+
150+
data = {
151+
"AWS_KMS_KEY_ID" = local.kms_key_id
152+
}
153+
154+
depends_on = [kubernetes_namespace.zama_protocol_namespace]
155+
}

‎modules/zama-protocol-pauser-wallet/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "aws_kms_key_id" {
2+
description = "Summary of the KMS Key for the application"
3+
value = local.kms_key_id
4+
}

‎modules/zama-protocol-pauser-wallet/variables.tf‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# ************
2+
# General variables
3+
# ************
4+
variable "tags" {
5+
type = map(string)
6+
description = "The tags for the KMS keys"
7+
}
8+
9+
# ************
10+
# Variables for usage in kms-for-mpc-party.tf
11+
# ************
12+
13+
variable "cluster_name" {
14+
type = string
15+
description = "Name of the cluster"
16+
default = null
17+
}
18+
19+
variable "app_name" {
20+
type = string
21+
description = "Name of the role"
22+
default = "zama-protocol-pause"
23+
}
24+
25+
variable "k8s_config_map_name" {
26+
type = string
27+
description = "Name of the configmap"
28+
default = "zama-protocol-pause"
29+
}
30+
31+
variable "k8s_config_map_create" {
32+
type = bool
33+
description = "Whether to create the configmap for that holds AWS_KMS_KEY_ID"
34+
default = true
35+
}
36+
37+
variable "k8s_service_account_name" {
38+
type = string
39+
description = "Name of the service account"
40+
default = "zama-protocol-pause"
41+
}
42+
43+
variable "k8s_service_account_create" {
44+
type = bool
45+
description = "Whether to create the service account for the KMS key"
46+
default = true
47+
}
48+
49+
variable "k8s_namespace" {
50+
type = string
51+
description = "Namespace of the application"
52+
default = "zama-protocol"
53+
}
54+
55+
variable "k8s_create_namespace" {
56+
description = "Whether to create the namespace if it doesn't exist"
57+
type = bool
58+
default = false
59+
}
60+
61+
variable "zama_protocol_pauser_iam_assumable_role_enabled" {
62+
type = bool
63+
description = "Whether to enable the IAM assumable role for the application"
64+
default = false
65+
}
66+
67+
variable "kms_cross_account_iam_role_arn" {
68+
type = string
69+
description = "ARN of cross-account IAM role allowed for usage of KMS key"
70+
default = null
71+
}
72+
73+
variable "kms_key_usage" {
74+
type = string
75+
description = "Key usage for txsender"
76+
default = "SIGN_VERIFY"
77+
}
78+
79+
variable "kms_key_spec" {
80+
description = "Specification for the txsender (e.g., ECC_SECG_P256K1 for Ethereum key signing)"
81+
type = string
82+
default = "ECC_SECG_P256K1"
83+
}
84+
85+
variable "kms_deletion_window_in_days" {
86+
type = number
87+
description = "Deletion window in days for KMS key"
88+
default = 30
89+
}
90+
91+
variable "kms_use_cross_account_kms_key" {
92+
type = bool
93+
description = "Whether a KMS key has been created in a different AWS account"
94+
default = false
95+
}
96+
97+
variable "kms_cross_account_kms_key_id" {
98+
type = string
99+
description = "KMS key ID of KMS key created in a different AWS account"
100+
default = ""
101+
102+
validation {
103+
condition = !var.kms_use_cross_account_kms_key || (var.kms_use_cross_account_kms_key && var.kms_cross_account_kms_key_id != "")
104+
error_message = "kms_cross_account_kms_key_id must be provided when kms_use_cross_account_kms_key is true."
105+
}
106+
}

‎modules/zama-protocol-pauser-wallet/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 6.0"
8+
}
9+
kubernetes = {
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.23"
12+
}
13+
}
14+
}

0 commit comments

Comments
 (0)