chore: update cfn template to allow hierarchical keyring to call kms:GenerateDataKeyWithoutPlaintext

imabhichow · imabhichow · commit d6f25aa8c7cd · 2023-09-25T17:42:34.000-07:00
diff --git a/cfn/ci_cd.yml b/cfn/ci_cd.yml
@@ -382,12 +382,15 @@ Resources:
               "Effect": "Allow",
               "Resource": [
                 "arn:aws:kms:*:658956600833:key/*",
-                "arn:aws:kms:*:658956600833:alias/*"
+                "arn:aws:kms:*:658956600833:alias/*",
+                "arn:aws:kms:*:370957321024:key/*",
+                "arn:aws:kms:*:370957321024:alias/*"
               ],
               "Action": [
                 "kms:Encrypt",
                 "kms:Decrypt",
-                "kms:GenerateDataKey"
+                "kms:GenerateDataKey",
+                "kms:GenerateDataKeyWithoutPlaintext"
               ]
             }
           ]

Original file line number	Diff line number	Diff line change
`@@ -382,12 +382,15 @@ Resources:`
`382`	`382`	`"Effect": "Allow",`
`383`	`383`	`"Resource": [`
`384`	`384`	`"arn:aws:kms::658956600833:key/",`
`385`		`- "arn:aws:kms::658956600833:alias/"`
	`385`	`+ "arn:aws:kms::658956600833:alias/",`
	`386`	`+ "arn:aws:kms::370957321024:key/",`
	`387`	`+ "arn:aws:kms::370957321024:alias/"`
`386`	`388`	`],`
`387`	`389`	`"Action": [`
`388`	`390`	`"kms:Encrypt",`
`389`	`391`	`"kms:Decrypt",`
`390`		`- "kms:GenerateDataKey"`
	`392`	`+ "kms:GenerateDataKey",`
	`393`	`+ "kms:GenerateDataKeyWithoutPlaintext"`
`391`	`394`	`]`
`392`	`395`	`}`
`393`	`396`	`]`