Update storage module configuration for Bedrock service principal access

Author: laurencegoolsby

infra/app-flask/service/document_data_extraction.tf

@@ -33,23 +33,23 @@ module "dde_input_bucket" {
     aws = aws.dde
   }
 
-  count                      = local.document_data_extraction_config != null ? 1 : 0
-  source                     = "../../modules/storage"
-  name                       = "${local.prefix}${local.document_data_extraction_config.input_bucket_name}"
-  is_temporary               = local.is_temporary
-  use_aws_managed_encryption = true
+  count                          = local.document_data_extraction_config != null ? 1 : 0
+  source                         = "../../modules/storage"
+  name                           = "${local.prefix}${local.document_data_extraction_config.input_bucket_name}"
+  is_temporary                   = local.is_temporary
+  service_principals_with_access = ["bedrock.amazonaws.com"]
 }
 
 module "dde_output_bucket" {
   providers = {
     aws = aws.dde
   }
 
-  count                      = local.document_data_extraction_config != null ? 1 : 0
-  source                     = "../../modules/storage"
-  name                       = "${local.prefix}${local.document_data_extraction_config.output_bucket_name}"
-  is_temporary               = local.is_temporary
-  use_aws_managed_encryption = true
+  count                          = local.document_data_extraction_config != null ? 1 : 0
+  source                         = "../../modules/storage"
+  name                           = "${local.prefix}${local.document_data_extraction_config.output_bucket_name}"
+  is_temporary                   = local.is_temporary
+  service_principals_with_access = ["bedrock.amazonaws.com"]
 }
 
 module "dde" {

infra/modules/storage/encryption.tf

@@ -50,8 +50,6 @@ data "aws_iam_policy_document" "kms_key_policy" {
 }
 
 resource "aws_kms_key" "storage" {
-  count = var.use_aws_managed_encryption ? 0 : 1
-
   description = "KMS key for bucket ${var.name}"
   # The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
   deletion_window_in_days = "10"
@@ -65,9 +63,9 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "storage" {
   bucket = aws_s3_bucket.storage.id
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = var.use_aws_managed_encryption ? null : aws_kms_key.storage[0].arn
-      sse_algorithm     = var.use_aws_managed_encryption ? "AES256" : "aws:kms"
+      kms_master_key_id = aws_kms_key.storage.arn
+      sse_algorithm     = "aws:kms"
     }
-    bucket_key_enabled = var.use_aws_managed_encryption ? null : true
+    bucket_key_enabled = true
   }
 }

infra/modules/storage/main.tf

@@ -9,5 +9,4 @@ resource "aws_s3_bucket" "storage" {
   # checkov:skip=CKV_AWS_144:Cross region replication not required by default
   # checkov:skip=CKV2_AWS_62:S3 bucket does not need notifications enabled
   # checkov:skip=CKV_AWS_21:Bucket versioning is not needed
-  # checkov:skip=CKV_AWS_145:AWS-managed encryption (AES256) used when use_aws_managed_encryption=true
 }