fix(rds-postgres-server): grant KMS permissions for storage encryption CMK

rds-postgres-server/specs/requirements/aws/main.tf

@@ -48,6 +48,12 @@ resource "aws_iam_role_policy_attachment" "rds_s3" {
   policy_arn = aws_iam_policy.nullplatform_rds_s3_policy[0].arn
 }
 
+resource "aws_iam_role_policy_attachment" "rds_kms" {
+  count      = local.iam_create ? 1 : 0
+  role       = aws_iam_role.nullplatform_rds_postgres_server[0].name
+  policy_arn = aws_iam_policy.nullplatform_rds_kms_policy[0].arn
+}
+
 ################################################################################
 # RDS IAM policy
 ################################################################################
@@ -196,3 +202,67 @@ resource "aws_iam_policy" "nullplatform_rds_secretsmanager_policy" {
     ]
   })
 }
+
+################################################################################
+# KMS IAM policy
+################################################################################
+
+# Grant permissions to create and manage the customer-managed KMS key used
+# for RDS storage encryption, scoped to keys this role itself tags
+resource "aws_iam_policy" "nullplatform_rds_kms_policy" {
+  count = local.iam_create ? 1 : 0
+
+  name        = "${local.policies_name_prefix}-rds-kms-policy"
+  description = "Policy for managing the customer-managed KMS key used for RDS storage encryption, scoped to keys tagged managed-by=nullplatform"
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Sid" : "CreateOwnCMK",
+        "Effect" : "Allow",
+        "Action" : "kms:CreateKey",
+        "Resource" : "*",
+        "Condition" : {
+          "StringEquals" : { "aws:RequestTag/managed-by" : "nullplatform" }
+        }
+      },
+      {
+        "Sid" : "ManageOwnCMK",
+        "Effect" : "Allow",
+        "Action" : [
+          "kms:TagResource",
+          "kms:DescribeKey",
+          "kms:GetKeyPolicy",
+          "kms:EnableKeyRotation",
+          "kms:GetKeyRotationStatus",
+          "kms:ListResourceTags",
+          "kms:ScheduleKeyDeletion",
+          "kms:CancelKeyDeletion",
+          "kms:CreateGrant",
+          "kms:ListGrants",
+          "kms:RevokeGrant",
+          "kms:CreateAlias",
+          "kms:DeleteAlias",
+          "kms:UpdateAlias"
+        ],
+        "Resource" : "*",
+        "Condition" : {
+          "StringEquals" : { "aws:ResourceTag/managed-by" : "nullplatform" }
+        }
+      },
+      {
+        "Sid" : "ManageOwnAlias",
+        "Effect" : "Allow",
+        "Action" : ["kms:CreateAlias", "kms:DeleteAlias", "kms:UpdateAlias"],
+        "Resource" : "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:alias/nullplatform-*"
+      },
+      {
+        "Sid" : "ListAliases",
+        "Effect" : "Allow",
+        "Action" : "kms:ListAliases",
+        "Resource" : "*"
+      }
+    ]
+  })
+}

rds-postgres-server/specs/requirements/aws/output.tf

@@ -13,6 +13,11 @@ output "rds_secretsmanager_policy_arn" {
   value       = local.iam_create ? aws_iam_policy.nullplatform_rds_secretsmanager_policy[0].arn : ""
 }
 
+output "rds_kms_policy_arn" {
+  description = "ARN of the KMS policy for the customer-managed RDS storage encryption key"
+  value       = local.iam_create ? aws_iam_policy.nullplatform_rds_kms_policy[0].arn : ""
+}
+
 output "permissions_role_arn" {
   description = "ARN of the rds-postgres-server permissions role assumed by the nullplatform agent role. Pass to the agent (assume_role_arns)."
   value       = local.iam_create ? aws_iam_role.nullplatform_rds_postgres_server[0].arn : ""