Update format and outputs

Author: lorenzo-merici

modules/integrations/cloud-logs/main.tf

@@ -29,6 +29,8 @@ data "aws_caller_identity" "current" {}
 
 data "aws_region" "current" {}
 
+data "aws_partition" "current" {}
+
 data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
   cloud_provider = "aws"
 }
@@ -149,7 +151,7 @@ data "aws_iam_policy_document" "cloudlogs_s3_access" {
   }
 
   dynamic "statement" {
-    for_each = var.kms_key_arns != null && !local.is_cross_account ? [1] : []
+    for_each = var.kms_key_arn != null && !local.is_cross_account ? [1] : []
     content {
       sid = "CloudlogsKMSDecrypt"
 
@@ -159,7 +161,7 @@ data "aws_iam_policy_document" "cloudlogs_s3_access" {
         "kms:Decrypt"
       ]
 
-      resources = var.kms_key_arns
+      resources = [var.kms_key_arn]
     }
   }
 }
@@ -209,17 +211,16 @@ resource "aws_cloudformation_stack_set" "bucket_permissions" {
   name             = local.stackset_name
   description      = "StackSet to configure S3 bucket and KMS permissions for Sysdig Cloud Logs integration"
   template_body    = templatefile("${path.module}/stackset_template_body.tpl", {
-    bucket_name      = local.bucket_name
-    bucket_arn       = var.bucket_arn
-    kms_key_arns     = var.kms_key_arns
-    bucket_account_id = local.bucket_account_id
+    bucket_arn = var.bucket_arn
+    kms_key_arn = var.kms_key_arn
   })
 
   parameters = {
     RoleName = local.role_name
     BucketAccountId = local.bucket_account_id
     SysdigTrustedIdentity = local.trusted_identity
     SysdigExternalId = data.sysdig_secure_tenant_external_id.external_id.external_id
+    KmsKeyArn = var.kms_key_arn
   }
 
   permission_model       = "SERVICE_MANAGED"

modules/integrations/cloud-logs/outputs.tf

@@ -3,3 +3,15 @@ output "cloud_logs_component_id" {
   description = "Component identifier of Cloud Logs integration created in Sysdig Backend for Log Ingestion"
   depends_on  = [sysdig_secure_cloud_auth_account_component.aws_cloud_logs]
 }
+
+output "kms_policy_instructions" {
+  description = "Instructions for updating KMS key policy when KMS encryption is enabled"
+  value = (var.kms_key_arn != null) ? templatefile(
+    "${path.module}/templates/kms_policy_instructions.tpl",
+    {
+      role_arn = "arn:${data.aws_partition.current.partition}:iam::${local.bucket_account_id}:role/${local.role_name}"
+      region = data.aws_region.current.name
+      bucket_name = local.bucket_name
+    }
+  ) : ""
+}

modules/integrations/cloud-logs/stackset_template_body.tpl

@@ -17,6 +17,10 @@
     "SysdigExternalId": {
       "Type": "String",
       "Description": "External ID for secure role assumption by Sysdig"
+    },
+    "KmsKeyArn": {
+      "Type": "String",
+      "Description": "ARN of the KMS key used for encryption"
     }
   },
   "Conditions": {
@@ -30,12 +34,12 @@
         }
       ]
     },
-    "HasKMSKeys": {
+    "HasKMSKey": {
       "Fn::Not": [
         {
           "Fn::Equals": [
             {
-              "Fn::Join": ["", ${jsonencode(kms_key_arns != null ? kms_key_arns : [""])}]
+              "Ref": "KmsKeyArn"
             },
             ""
           ]
@@ -99,13 +103,13 @@
                     "${bucket_arn}/*"
                   ]
                 }
-                %{ if kms_key_arns != null }
+                %{ if kms_key_arn != null && kms_key_arn != "" }
                 ,
                 {
                   "Sid": "KMSDecryptAccess",
                   "Effect": "Allow",
                   "Action": "kms:Decrypt",
-                  "Resource": ${jsonencode(kms_key_arns)}
+                  "Resource": "${kms_key_arn}"
                 }
                 %{ endif }
               ]

modules/integrations/cloud-logs/templates/kms_policy_instructions.tpl

@@ -0,0 +1,9 @@
+{
+  "Sid": "Sysdig-Decrypt",
+  "Effect": "Allow",
+  "Principal": {
+    "AWS": "${role_arn}"
+  },
+  "Action": "kms:Decrypt",
+  "Resource": "*"
+}

modules/integrations/cloud-logs/variables.tf

@@ -101,3 +101,9 @@ variable "org_units" {
   description = "List of AWS Organizations organizational unit (OU) IDs in which to create the StackSet instances. Required if is_organizational is true."
   default     = []
 }
+
+variable "kms_key_arn" {
+  description = "ARN of the KMS key used for encryption. If provided, the role will be granted decrypt permissions."
+  type        = string
+  default     = null
+}