From 44e5a7e6f2587de207fcab3202ff4f6168d75721 Mon Sep 17 00:00:00 2001
From: Leandro Timossi <leandro.timossi@nullplatform.io>
Date: Mon, 24 Aug 2026 16:27:30 -0300
Subject: [PATCH] fix: add KMS IAM policy to the aurora-postgres-server
 permissions role

Release 0.0.2 moved Aurora storage encryption to a customer managed key
(5f71cc7, AVD-AWS-0079): deployment/main.tf creates aws_kms_key.aurora and
aws_kms_alias.aurora and feeds the key ARN into aws_rds_cluster.main. The
AssumeRole permissions role was never updated to match, so the agent's KMS
calls are denied: the service cannot finish its first apply, and a destroy
leaves the key and its alias behind.

Adds <prefix>-rds-kms-policy plus its role attachment, gated by the same
local.iam_create flag as the rest of the policies in the module:

- KmsCreateAndList: CreateKey, TagResource, ListKeys and ListAliases on "*",
  since there is no key ARN to scope to before CreateKey returns.
- KmsManageKey: describe, key policy, rotation, tags and lifecycle, scoped to
  keys in the current account.
- KmsCreateGrantForRds: CreateGrant, ListGrants and RevokeGrant gated on
  kms:GrantIsForAWSResource, which RDS requires to attach the key to the
  cluster.
- KmsManageAlias: alias create, update and delete on alias/nullplatform-aurora-*
  plus the target key, since the alias APIs authorize against both.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../specs/requirements/aws/main.tf            | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/aurora-postgres-server/specs/requirements/aws/main.tf b/aurora-postgres-server/specs/requirements/aws/main.tf
index 01f8c3f..4cdb691 100644
--- a/aurora-postgres-server/specs/requirements/aws/main.tf
+++ b/aurora-postgres-server/specs/requirements/aws/main.tf
@@ -48,6 +48,12 @@ resource "aws_iam_role_policy_attachment" "rds_s3" {
   policy_arn = aws_iam_policy.nullplatform_rds_s3_policy[0].arn
 }
 
+resource "aws_iam_role_policy_attachment" "rds_kms" {
+  count      = local.iam_create ? 1 : 0
+  role       = aws_iam_role.nullplatform_aurora_postgres_server[0].name
+  policy_arn = aws_iam_policy.nullplatform_rds_kms_policy[0].arn
+}
+
 ################################################################################
 # RDS/Aurora IAM policy
 ################################################################################
@@ -198,3 +204,82 @@ resource "aws_iam_policy" "nullplatform_rds_secretsmanager_policy" {
     ]
   })
 }
+
+
+################################################################################
+# KMS IAM policy
+################################################################################
+
+resource "aws_iam_policy" "nullplatform_rds_kms_policy" {
+  count = local.iam_create ? 1 : 0
+
+  name        = "${local.policies_name_prefix}-rds-kms-policy"
+  description = "Policy for managing KMS keys for the Aurora Cluster"
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Sid" : "KmsCreateAndList",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:CreateKey",
+          "kms:TagResource",
+          "kms:ListKeys",
+          "kms:ListAliases"
+        ],
+        "Resource" : "*"
+      },
+      {
+        "Sid" : "KmsManageKey",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:DescribeKey",
+          "kms:GetKeyPolicy",
+          "kms:GetKeyRotationStatus",
+          "kms:ListResourceTags",
+          "kms:ListKeyPolicies",
+          "kms:EnableKeyRotation",
+          "kms:DisableKeyRotation",
+          "kms:UpdateKeyDescription",
+          "kms:PutKeyPolicy",
+          "kms:TagResource",
+          "kms:UntagResource",
+          "kms:EnableKey",
+          "kms:DisableKey",
+          "kms:ScheduleKeyDeletion",
+          "kms:CancelKeyDeletion"
+        ],
+        "Resource" : "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
+      },
+      {
+        "Sid" : "KmsCreateGrantForRds",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:CreateGrant",
+          "kms:ListGrants",
+          "kms:RevokeGrant"
+        ],
+        "Resource" : "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*",
+        "Condition" : {
+          "Bool" : {
+            "kms:GrantIsForAWSResource" : "true"
+          }
+        }
+      },
+      {
+        "Sid" : "KmsManageAlias",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:CreateAlias",
+          "kms:UpdateAlias",
+          "kms:DeleteAlias"
+        ],
+        "Resource" : [
+          "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:alias/nullplatform-aurora-*",
+          "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:key/*"
+        ]
+      }
+    ]
+  })
+}