Skip to content

Commit a34cc37

Browse files
fegmortefegmorte
authored
Merge pull request #88 from zama-ai/fred/fix/fix-terraform-module
fix: Fix teraform modules
2 parents 3b6e2d8 + 9a3c19f commit a34cc37

File tree

5 files changed

+5
-111
lines changed

5 files changed

+5
-111
lines changed

‎modules/mpc-backup-key/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ No modules.
3232
| <a name="input_mpc_party_cross_account_iam_role_arn"></a> [mpc\_party\_cross\_account\_iam\_role\_arn](#input\_mpc\_party\_cross\_account\_iam\_role\_arn) | ARN of cross-account IAM role allowed for usage of KMS key | `string` | `null` | no |
3333
| <a name="input_mpc_party_kms_alias"></a> [mpc\_party\_kms\_alias](#input\_mpc\_party\_kms\_alias) | Alias for the KMS key | `string` | `null` | no |
3434
| <a name="input_mpc_party_kms_backup_description"></a> [mpc\_party\_kms\_backup\_description](#input\_mpc\_party\_kms\_backup\_description) | Description of KMS Key | `string` | `"Asymmetric KMS key backup for MPC Party"` | no |
35-
| <a name="input_mpc_party_kms_backup_vault_customer_master_key_spec"></a> [mpc\_party\_kms\_backup\_vault\_customer\_master\_key\_spec](#input\_mpc\_party\_kms\_backup\_vault\_customer\_master\_key\_spec) | Key spec for the backup vault | `string` | `"ASYMMETRIC_DEFAULT"` | no |
35+
| <a name="input_mpc_party_kms_backup_vault_customer_master_key_spec"></a> [mpc\_party\_kms\_backup\_vault\_customer\_master\_key\_spec](#input\_mpc\_party\_kms\_backup\_vault\_customer\_master\_key\_spec) | Key spec for the backup vault | `string` | `"RSA_4096"` | no |
3636
| <a name="input_mpc_party_kms_backup_vault_key_usage"></a> [mpc\_party\_kms\_backup\_vault\_key\_usage](#input\_mpc\_party\_kms\_backup\_vault\_key\_usage) | Key usage for the backup vault | `string` | `"ENCRYPT_DECRYPT"` | no |
3737
| <a name="input_mpc_party_kms_deletion_window_in_days"></a> [mpc\_party\_kms\_deletion\_window\_in\_days](#input\_mpc\_party\_kms\_deletion\_window\_in\_days) | Deletion window in days for KMS key | `number` | `30` | no |
3838
| <a name="input_mpc_party_kms_image_attestation_sha"></a> [mpc\_party\_kms\_image\_attestation\_sha](#input\_mpc\_party\_kms\_image\_attestation\_sha) | Attestation SHA for KMS image | `string` | `null` | no |

‎modules/mpc-backup-key/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,5 +54,5 @@ variable "mpc_party_kms_backup_vault_key_usage" {
5454
variable "mpc_party_kms_backup_vault_customer_master_key_spec" {
5555
type = string
5656
description = "Key spec for the backup vault"
57-
default = "ASYMMETRIC_DEFAULT"
57+
default = "RSA_4096"
5858
}

‎modules/mpc-party/README.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -328,10 +328,8 @@ The module can optionally create:
328328
| [aws_iam_policy.mpc_core_kms_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
329329
| [aws_kms_alias.mpc_connector_tx_sender](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
330330
| [aws_kms_alias.mpc_party](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
331-
| [aws_kms_alias.mpc_party_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
332331
| [aws_kms_external_key.mpc_connector_tx_sender](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_external_key) | resource |
333332
| [aws_kms_key.mpc_party](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
334-
| [aws_kms_key.mpc_party_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
335333
| [aws_s3_bucket.vault_private_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
336334
| [aws_s3_bucket.vault_public_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
337335
| [aws_s3_bucket_cors_configuration.vault_public_bucket_cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
@@ -376,10 +374,7 @@ The module can optionally create:
376374
| <a name="input_enable_rds"></a> [enable\_rds](#input\_enable\_rds) | Whether to create the RDS instance | `bool` | `true` | no |
377375
| <a name="input_k8s_namespace"></a> [k8s\_namespace](#input\_k8s\_namespace) | The Kubernetes namespace for MPC party resources | `string` | `"kms-decentralized"` | no |
378376
| <a name="input_k8s_service_account_name"></a> [k8s\_service\_account\_name](#input\_k8s\_service\_account\_name) | The name of the Kubernetes service account for MPC party | `string` | n/a | yes |
379-
| <a name="input_kms_backup_external_role_arn"></a> [kms\_backup\_external\_role\_arn](#input\_kms\_backup\_external\_role\_arn) | ARN of the backup vault for the KMS key | `string` | `null` | no |
380377
| <a name="input_kms_backup_vault_bucket_name"></a> [kms\_backup\_vault\_bucket\_name](#input\_kms\_backup\_vault\_bucket\_name) | Backup vault S3 bucket name | `string` | `null` | no |
381-
| <a name="input_kms_backup_vault_customer_master_key_spec"></a> [kms\_backup\_vault\_customer\_master\_key\_spec](#input\_kms\_backup\_vault\_customer\_master\_key\_spec) | Key spec for the backup vault | `string` | `"ASYMMETRIC_DEFAULT"` | no |
382-
| <a name="input_kms_backup_vault_key_usage"></a> [kms\_backup\_vault\_key\_usage](#input\_kms\_backup\_vault\_key\_usage) | Key usage for the backup vault | `string` | `"ENCRYPT_DECRYPT"` | no |
383378
| <a name="input_kms_backup_vault_kms_key_arn"></a> [kms\_backup\_vault\_kms\_key\_arn](#input\_kms\_backup\_vault\_kms\_key\_arn) | KMS key ARN for the backup vault | `string` | `null` | no |
384379
| <a name="input_kms_connector_enable_txsender_key"></a> [kms\_connector\_enable\_txsender\_key](#input\_kms\_connector\_enable\_txsender\_key) | Whether to enable the KMS key for the kms-connector txsender | `bool` | `false` | no |
385380
| <a name="input_kms_connector_txsender_key_spec"></a> [kms\_connector\_txsender\_key\_spec](#input\_kms\_connector\_txsender\_key\_spec) | Specification for the KMS-Connector txsender (e.g., ECC\_SECG\_P256K1 for Ethereum key signing) | `string` | `"ECC_SECG_P256K1"` | no |

‎modules/mpc-party/main.tf‎

Lines changed: 0 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,6 @@ resource "kubernetes_service_account" "mpc_kms_connector_service_account" {
350350
# ***************************************
351351
locals {
352352
create_mpc_party_key = var.kms_enabled_nitro_enclaves && !var.kms_use_cross_account_kms_key
353-
create_mpc_party_key_backup = var.kms_enabled_nitro_enclaves && var.kms_enable_backup_vault && !var.kms_use_cross_account_kms_key
354353
create_mpc_connector_txsender_key = var.kms_connector_enable_txsender_key && !var.kms_use_cross_account_kms_key
355354

356355
kms_key_id = var.kms_enabled_nitro_enclaves ? (
@@ -434,87 +433,6 @@ resource "aws_kms_alias" "mpc_party" {
434433
target_key_id = aws_kms_key.mpc_party[0].key_id
435434
}
436435

437-
# ***************************************
438-
# ASYMMETRIC KMS Key Backup for MPC Party
439-
# ***************************************
440-
resource "aws_kms_key" "mpc_party_backup" {
441-
count = local.create_mpc_party_key_backup ? 1 : 0
442-
443-
description = "Asymmetric KMS key backup for MPC Party"
444-
key_usage = var.kms_backup_vault_key_usage
445-
customer_master_key_spec = var.kms_backup_vault_customer_master_key_spec
446-
enable_key_rotation = false
447-
deletion_window_in_days = var.kms_deletion_window_in_days
448-
tags = var.tags
449-
450-
policy = jsonencode({
451-
Version = "2012-10-17"
452-
Statement = [
453-
{
454-
Effect = "Allow",
455-
Principal = {
456-
AWS = var.kms_backup_external_role_arn
457-
},
458-
Action = [
459-
"kms:GetPublicKey",
460-
"kms:DescribeKey",
461-
"kms:GetKeyPolicy",
462-
],
463-
Resource = "*"
464-
},
465-
{
466-
Effect = "Allow",
467-
Principal = {
468-
AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${module.iam_assumable_role_mpc_party.iam_role_name}"
469-
},
470-
Action = [
471-
"kms:Decrypt",
472-
"kms:GenerateDataKey",
473-
],
474-
Resource = "*",
475-
Condition = {
476-
StringEqualsIgnoreCase = {
477-
"kms:RecipientAttestation:ImageSha384" : var.kms_image_attestation_sha
478-
}
479-
}
480-
},
481-
{
482-
Effect = "Allow",
483-
Principal = {
484-
AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
485-
},
486-
Action = [
487-
"kms:Create*",
488-
"kms:Describe*",
489-
"kms:Enable*",
490-
"kms:List*",
491-
"kms:Put*",
492-
"kms:Update*",
493-
"kms:Revoke*",
494-
"kms:Disable*",
495-
"kms:Get*",
496-
"kms:Delete*",
497-
"kms:TagResource",
498-
"kms:UntagResource",
499-
"kms:ScheduleKeyDeletion",
500-
"kms:CancelKeyDeletion"
501-
],
502-
Resource = "*"
503-
}
504-
]
505-
})
506-
}
507-
508-
# ***************************************
509-
# KMS Key Alias for MPC Party Backup
510-
# ***************************************
511-
resource "aws_kms_alias" "mpc_party_backup" {
512-
count = local.create_mpc_party_key_backup ? 1 : 0
513-
514-
name = "alias/mpc-${var.party_name}-backup"
515-
target_key_id = aws_kms_key.mpc_party_backup[0].key_id
516-
}
517-
518436
# ***************************************
519437
# KMS-Connector Ethereum TxSender Key
520438
# ***************************************

‎modules/mpc-party/variables.tf‎

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -404,6 +404,9 @@ variable "kms_connector_txsender_key_spec" {
404404

405405
#******************************************************
406406
# Backup Vault Configuration
407+
# We use :
408+
# - mpc-backup-key terraform module to create the kms backup key
409+
# - mpc-backup-vault terraform module to create the kms backup bucket
407410
#******************************************************
408411
variable "kms_enable_backup_vault" {
409412
type = bool
@@ -422,28 +425,6 @@ variable "kms_backup_vault_kms_key_arn" {
422425
description = "KMS key ARN for the backup vault"
423426
default = null
424427
}
425-
426-
#******************************************************
427-
# We use :
428-
# - mpc-backup-key terraform module to create the kms backup key
429-
# - mpc-backup-vault terraform module to create the kms backup bucket
430-
#******************************************************
431-
variable "kms_backup_external_role_arn" {
432-
type = string
433-
description = "ARN of the backup vault for the KMS key"
434-
default = null
435-
}
436-
variable "kms_backup_vault_key_usage" {
437-
type = string
438-
description = "Key usage for the backup vault"
439-
default = "ENCRYPT_DECRYPT"
440-
}
441-
442-
variable "kms_backup_vault_customer_master_key_spec" {
443-
type = string
444-
description = "Key spec for the backup vault"
445-
default = "ASYMMETRIC_DEFAULT"
446-
}
447428
#******************************************************
448429

449430
variable "nodegroup_enable_ssm_managed_instance" {

0 commit comments

Comments
 (0)