I have Encrypted SNS topic with KMS key. Here is KMS policy: Type: 'AWS::KMS::Key' Properties: Description: Key for SNS Encryption Enabled: true EnableKeyRotation: true KeyPolicy: Version: 2012-10-17 Id: KmsKeyPolicy Statement: - Sid: AllowDFX5AdminPermissionSet Effect: Allow Principal: AWS: !Ref ParamKMSKeyAdministratorUserRoleArn Action:…
I keep getting this error but I can't seem to spot what is wrong with my policy. Can someone help? This is my aws_kms_key_policy? resource "aws_kms_key_policy" "kms_key" { key_id = aws_kms_key.kms_key.key_id policy = jsonencode({ Id = "kms-key-policy", Statement = […
To enable cross-account S3 data sharing we decided to implement use of customer-managed KMS keys. Before we used AWS default KMS key (SSE-S3) and things worked great. We expected the switch to customer-managed keys (SSE-KMS) to be seamless, as in…
I created a new ASG that creates instances using an AMI that has been created and encrypted in another account (account id: 111). Any instance that creates in the ASG crashes right away with an error of Client.InternalError: Client error…
I am trying to enable server side encryption(SSE) for objects in S3. I went through the AWS S3 documentation and understood that when you configure bucket to enable SSE (in my case, using KMS CMK) under bucket properties, any object…
I'm provisioning Kinesis Data Stream with AWS managed KMS key as well as Delivery Stream reading from stream. There's a problem on how to add decrypt policy on delivery stream role for managed key. The code is showing below and…
I was going by this update for EKS https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/ and this blog from AWS https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/. This is a very cryptic line which never confirms whether EKS encrypts secrets or not by default In EKS, we operate the etcd volumes encrypted…
I'm running a PHP application that connects to a RDS database using username and password to serve data to clients. The username and password are retrieved from AWS KMS as encrypted string using AWS SSM client. I do this for…