Add support for TDE key rotation

Author: whites11

docs/resources/service.md

@@ -162,9 +162,9 @@ Required:
 
 - `enabled` (Boolean) If true, TDE is enabled for the service.
 
-Optional:
+Read-Only:
 
-- `key_id` (String) ID of the Encryption key to use for data encryption. Must be an ARN for AWS services or a Key Resource Path for GCP services.
+- `role_id` (String) ID of Role to be used for granting access to the Encryption Key. This is an ARN for AWS services and a Service Account Identifier for GCP.
 
 
 <a id="nestedatt--private_endpoint_config"></a>

docs/resources/service_transparent_data_encryption_key_association.md

@@ -0,0 +1,52 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "clickhouse_service_transparent_data_encryption_key_association Resource - clickhouse"
+subcategory: ""
+description: |-
+  You can use the clickhouse_service resource to deploy ClickHouse cloud instances on supported cloud providers.
+  Known limitations:
+  If you create a service with warehouse_id set and then remove warehouse_id attribute completely, the provider won't detect the change. If you want to make a secondary service become primary, remove the warehouse_id and taint it before applying.If you create a service with readonly flag set to true and then remove readonly flag completely, the provider won't detect the change. If you want to make a secondary service read write, explicitly set the readonly flag to false.
+---
+
+# clickhouse_service_transparent_data_encryption_key_association (Resource)
+
+You can use the *clickhouse_service* resource to deploy ClickHouse cloud instances on supported cloud providers.
+
+Known limitations:
+
+- If you create a service with `warehouse_id` set and then remove `warehouse_id` attribute completely, the provider won't detect the change. If you want to make a secondary service become primary, remove the `warehouse_id` and taint it before applying.
+- If you create a service with `readonly` flag set to true and then remove `readonly` flag completely, the provider won't detect the change. If you want to make a secondary service read write, explicitly set the `readonly` flag to false.
+
+## Example Usage
+
+```terraform
+resource "clickhouse_service" "service" {
+  ...
+}
+
+resource "aws_kms_key" "enc" {
+  ...
+}
+
+resource "clickhouse_service_transparent_data_encryption_key_association" "service_key_association" {
+  service_id = clickhouse_service.service.id
+  key_id = aws_kms_key.enc.arn
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key_id` (String) ID of the Encryption key to use for data encryption. Must be an ARN for AWS services or a Key Resource Path for GCP services.
+- `service_id` (String) ClickHouse Service ID
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Endpoint Attachments can be imported by specifying the clickhouse service UUID
+terraform import clickhouse_service_transparent_data_encryption_key_association.example xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```

examples/tde/aws/README.md renamed to examples/full/tde/aws/README.md

@@ -0,0 +1,107 @@
+variable "aws_key" {
+  type = string
+}
+
+variable "aws_secret" {
+  type = string
+}
+
+variable "aws_session_token" {
+  type = string
+  default = ""
+}
+
+locals {
+  tags = {
+    Name = var.service_name
+  }
+}
+
+provider "aws" {
+  region     = var.region
+  access_key = var.aws_key
+  secret_key = var.aws_secret
+  token      = var.aws_session_token
+}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_policy_document" "policy" {
+  # Allow root user on the account all access.
+  statement {
+    sid = "AllowRoot"
+
+    actions   = ["kms:*"]
+    resources = ["*"]
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+  }
+
+  # Allow user that runs terraform to manage the KMS key.
+  statement {
+    sid = "AllowAdmins"
+    actions = [
+      "kms:Create*",
+      "kms:Describe*",
+      "kms:Enable*",
+      "kms:List*",
+      "kms:Put*",
+      "kms:Update*",
+      "kms:Revoke*",
+      "kms:Disable*",
+      "kms:Get*",
+      "kms:Delete*",
+      "kms:TagResource",
+      "kms:UntagResource",
+      "kms:ScheduleKeyDeletion",
+      "kms:CancelKeyDeletion",
+      "kms:RotateKeyOnDemand",
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:ReEncrypt*",
+      "kms:DescribeKey",
+      "kms:CreateGrant",
+      "kms:ListGrants",
+      "kms:RevokeGrant"
+    ]
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = [data.aws_caller_identity.current.arn]
+    }
+  }
+
+  # Allow clickhouse's accounts to access the KMS key.
+  statement {
+    sid = "AllowClickHouse"
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:ReEncrypt*",
+      "kms:DescribeKey",
+    ]
+    resources = ["*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = [clickhouse_service.service.transparent_data_encryption.role_id]
+    }
+  }
+}
+
+resource "aws_kms_key" "enc" {
+  customer_master_key_spec = "SYMMETRIC_DEFAULT"
+  deletion_window_in_days  = 7
+  description              = var.service_name
+  enable_key_rotation      = false
+  is_enabled               = true
+  key_usage                = "ENCRYPT_DECRYPT"
+  multi_region             = false
+
+  policy = data.aws_iam_policy_document.policy.json
+
+  tags = local.tags
+}

examples/full/tde/aws/aws.tf

@@ -59,10 +59,14 @@ resource "clickhouse_service" "service" {
 
   transparent_data_encryption = {
     enabled = true
-    key_id = "arn:aws:kms:us-east-2:XXXXXXXX:key/12345-6789-abcd-ef01-23456789abcde"
   }
 }
 
+resource "clickhouse_service_transparent_data_encryption_key_association" "service_key_association" {
+  service_id = clickhouse_service.service.id
+  key_id = aws_kms_key.enc.arn
+}
+
 output "service_endpoints" {
   value = clickhouse_service.service.endpoints
 }

examples/tde/aws/main.tf renamed to examples/full/tde/aws/main.tf

@@ -2,3 +2,8 @@
 organization_id = "aee076c1-3f83-4637-95b1-ad5a0a825b71"
 token_key       = "avhj1U5QCdWAE9CA9"
 token_secret    = "4b1dROiHQEuSXJHlV8zHFd0S7WQj7CGxz5kGJeJnca"
+
+# AWS
+aws_key                      = "key"
+aws_secret                   = "secret"
+aws_region                   = "us-west-2"

examples/tde/aws/provider.tf renamed to examples/full/tde/aws/provider.tf

@@ -73,7 +73,6 @@ resource "clickhouse_service" "service" {
 
   transparent_data_encryption = {
     enabled = true
-    key_id = "arn:aws:kms:us-east-2:XXXXXXXX:key/12345-6789-abcd-ef01-23456789abcde"
   }
 }