feat: Grant Velero permissions to restore encrypted EBS snapshots. (#56)

tropnikovvl · web-flow · commit d5e7fe6f8183 · 2025-12-22T08:17:49.000-06:00
diff --git a/velero.tf b/velero.tf
@@ -55,6 +55,11 @@ data "aws_iam_policy_document" "velero" {
         "kms:ReEncrypt*",
         "kms:GenerateDataKey*",
         "kms:DescribeKey",
+        "kms:CreateGrant",
+        "kms:ListGrants",
+        "kms:RevokeGrant",
+        "kms:RetireGrant",
+        "kms:ListRetirableGrants",
       ]
 
       resources = var.velero_kms_arns
