mirror of
https://github.com/Sea-Haven-Industries/sh-openswe-traces.git
synced 2026-09-30 04:33:14 +00:00
5f430d9dfd
Freeze SAM CD and add terraform/ for seahaven-prod with account-suffixed buckets so HCP owns deploy before mgmt cutover. Suppress CKV_AWS_40 for the LangSmith export IAM user with documented mitigations.
25 lines
611 B
HCL
25 lines
611 B
HCL
resource "aws_kms_key" "traces" {
|
|
description = "SSE-KMS CMK for sh-openswe-traces (LangSmith export archive)."
|
|
enable_key_rotation = true
|
|
deletion_window_in_days = 30
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Sid = "EnableIAMPolicies"
|
|
Effect = "Allow"
|
|
Principal = {
|
|
AWS = "arn:aws:iam::${local.account_id}:root"
|
|
}
|
|
Action = "kms:*"
|
|
Resource = "*"
|
|
}
|
|
]
|
|
})
|
|
}
|
|
|
|
resource "aws_kms_alias" "traces" {
|
|
name = local.kms_alias_name
|
|
target_key_id = aws_kms_key.traces.key_id
|
|
}
|