#6 update lambda permission

kunduso · Sep 2, 2024 · 553c2a8 · 553c2a8
1 parent adb6beb
commit 553c2a8
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/lambda_iam_role.tf b/lambda_iam_role.tf
@@ -39,6 +39,17 @@ resource "aws_iam_policy" "lambda_policy" {
         ]
         Resource = [aws_kms_key.encryption_rest.arn]
       },
+      {
+        Effect = "Allow",
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt",
+          "kms:GenerateDataKey",
+          "kms:Describe"
+        ]
+        Resource = [aws_kms_key.encryption_secret.arn]
+      },
       {
         Effect = "Allow",
         Action = [

diff --git a/rds.tf b/rds.tf
@@ -33,9 +33,10 @@ resource "aws_db_instance" "postgresql" {
   # CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
   deletion_protection = false
   #CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
-  copy_tags_to_snapshot         = true
-  performance_insights_enabled  = true
-  manage_master_user_password   = true
+  copy_tags_to_snapshot        = true
+  performance_insights_enabled = true
+  manage_master_user_password  = true
+  # password = 
   master_user_secret_kms_key_id = aws_kms_key.encryption_secret.arn
   # master_user_secret_kms_key_id = aws_kms_key.example.arn
   # kms_key_id = aws_kms_key.example.arn