Skip to content

Commit ed463c9

Browse files
piizamapiizama
authored
Merge pull request #83 from zama-ai/piizama/zama-protocol-pauser-wallet
feat: add zama protocol pauser wallet module (kms key)
2 parents c0ec7b6 + 9655151 commit ed463c9

6 files changed

Lines changed: 337 additions & 10 deletions

File tree

‎modules/mpc-party/variables.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -353,22 +353,12 @@ variable "kms_cross_account_kms_key_id" {
353353
type = string
354354
description = "KMS key ID of KMS key created in a different AWS account"
355355
default = ""
356-
357-
validation {
358-
condition = !var.kms_use_cross_account_kms_key || (var.kms_use_cross_account_kms_key && var.kms_cross_account_kms_key_id != "")
359-
error_message = "kms_cross_account_kms_key_id must be provided when kms_use_cross_account_kms_key is true."
360-
}
361356
}
362357

363358
variable "kms_cross_account_connector_txsender_key_id" {
364359
type = string
365360
description = "KMS key ID of Connector TxSender KMS key created in a different AWS account"
366361
default = ""
367-
368-
validation {
369-
condition = !var.kms_use_cross_account_kms_key || (var.kms_use_cross_account_kms_key && var.kms_cross_account_connector_txsender_key_id != "")
370-
error_message = "kms_cross_account_connector_txsender_key_id must be provided when kms_use_cross_account_kms_key is true."
371-
}
372362
}
373363

374364
variable "kms_key_usage" {

‎modules/zama-protocol-pauser-wallet/README.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
8+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.23 |
9+
10+
## Providers
11+
12+
| Name | Version |
13+
|------|---------|
14+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
15+
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.23 |
16+
17+
## Modules
18+
19+
| Name | Source | Version |
20+
|------|--------|---------|
21+
| <a name="module_iam_assumable_role_tx_sender"></a> [iam\_assumable\_role\_tx\_sender](#module\_iam\_assumable\_role\_tx\_sender) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | 5.48.0 |
22+
23+
## Resources
24+
25+
| Name | Type |
26+
|------|------|
27+
| [aws_iam_policy.app_kms_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
28+
| [aws_kms_alias.tx_sender](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
29+
| [aws_kms_external_key.tx_sender](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_external_key) | resource |
30+
| [kubernetes_config_map.mpc_party_config](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource |
31+
| [kubernetes_namespace.zama_protocol_namespace](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
32+
| [kubernetes_service_account.tx_sender_irsa](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account) | resource |
33+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
34+
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
35+
| [aws_iam_policy_document.tx_sender_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
36+
37+
## Inputs
38+
39+
| Name | Description | Type | Default | Required |
40+
|------|-------------|------|---------|:--------:|
41+
| <a name="input_app_name"></a> [app\_name](#input\_app\_name) | Name of the role | `string` | `"zama-protocol-pause"` | no |
42+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the cluster | `string` | `null` | no |
43+
| <a name="input_k8s_config_map_create"></a> [k8s\_config\_map\_create](#input\_k8s\_config\_map\_create) | Whether to create the configmap for that holds AWS\_KMS\_KEY\_ID | `bool` | `true` | no |
44+
| <a name="input_k8s_config_map_name"></a> [k8s\_config\_map\_name](#input\_k8s\_config\_map\_name) | Name of the configmap | `string` | `"zama-protocol-pause"` | no |
45+
| <a name="input_k8s_create_namespace"></a> [k8s\_create\_namespace](#input\_k8s\_create\_namespace) | Whether to create the namespace if it doesn't exist | `bool` | `false` | no |
46+
| <a name="input_k8s_namespace"></a> [k8s\_namespace](#input\_k8s\_namespace) | Namespace of the application | `string` | `"zama-protocol"` | no |
47+
| <a name="input_k8s_service_account_create"></a> [k8s\_service\_account\_create](#input\_k8s\_service\_account\_create) | Whether to create the service account for the KMS key | `bool` | `true` | no |
48+
| <a name="input_k8s_service_account_name"></a> [k8s\_service\_account\_name](#input\_k8s\_service\_account\_name) | Name of the service account | `string` | `"zama-protocol-pause"` | no |
49+
| <a name="input_kms_cross_account_iam_role_arn"></a> [kms\_cross\_account\_iam\_role\_arn](#input\_kms\_cross\_account\_iam\_role\_arn) | ARN of cross-account IAM role allowed for usage of KMS key | `string` | `null` | no |
50+
| <a name="input_kms_cross_account_kms_key_id"></a> [kms\_cross\_account\_kms\_key\_id](#input\_kms\_cross\_account\_kms\_key\_id) | KMS key ID of KMS key created in a different AWS account | `string` | `""` | no |
51+
| <a name="input_kms_deletion_window_in_days"></a> [kms\_deletion\_window\_in\_days](#input\_kms\_deletion\_window\_in\_days) | Deletion window in days for KMS key | `number` | `30` | no |
52+
| <a name="input_kms_key_spec"></a> [kms\_key\_spec](#input\_kms\_key\_spec) | Specification for the txsender (e.g., ECC\_SECG\_P256K1 for Ethereum key signing) | `string` | `"ECC_SECG_P256K1"` | no |
53+
| <a name="input_kms_key_usage"></a> [kms\_key\_usage](#input\_kms\_key\_usage) | Key usage for txsender | `string` | `"SIGN_VERIFY"` | no |
54+
| <a name="input_kms_use_cross_account_kms_key"></a> [kms\_use\_cross\_account\_kms\_key](#input\_kms\_use\_cross\_account\_kms\_key) | Whether a KMS key has been created in a different AWS account | `bool` | `false` | no |
55+
| <a name="input_tags"></a> [tags](#input\_tags) | The tags for the KMS keys | `map(string)` | n/a | yes |
56+
| <a name="input_zama_protocol_pauser_iam_assumable_role_enabled"></a> [zama\_protocol\_pauser\_iam\_assumable\_role\_enabled](#input\_zama\_protocol\_pauser\_iam\_assumable\_role\_enabled) | Whether to enable the IAM assumable role for the application | `bool` | `false` | no |
57+
58+
## Outputs
59+
60+
| Name | Description |
61+
|------|-------------|
62+
| <a name="output_aws_kms_key_id"></a> [aws\_kms\_key\_id](#output\_aws\_kms\_key\_id) | Summary of the KMS Key for the application |
63+
<!-- END_TF_DOCS -->

‎modules/zama-protocol-pauser-wallet/main.tf‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# ************
2+
# Data Sources
3+
# ************
4+
data "aws_caller_identity" "current" {}
5+
6+
data "aws_eks_cluster" "cluster" {
7+
name = var.cluster_name
8+
}
9+
10+
# Create Kubernetes namespace (optional)
11+
resource "kubernetes_namespace" "zama_protocol_namespace" {
12+
count = var.k8s_create_namespace ? 1 : 0
13+
14+
metadata {
15+
name = var.k8s_namespace
16+
}
17+
}
18+
19+
# ************
20+
# Application Ethereum Key
21+
# ************
22+
data "aws_iam_policy_document" "tx_sender_policy" {
23+
statement {
24+
effect = "Allow"
25+
principals {
26+
type = "AWS"
27+
identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
28+
}
29+
actions = [
30+
"kms:Create*",
31+
"kms:Describe*",
32+
"kms:Enable*",
33+
"kms:List*",
34+
"kms:Put*",
35+
"kms:Update*",
36+
"kms:Revoke*",
37+
"kms:Disable*",
38+
"kms:Get*",
39+
"kms:Delete*",
40+
"kms:TagResource",
41+
"kms:UntagResource",
42+
"kms:ScheduleKeyDeletion",
43+
"kms:CancelKeyDeletion",
44+
"kms:ImportKeyMaterial",
45+
"kms:DeleteImportedKeyMaterial"
46+
]
47+
resources = ["*"]
48+
}
49+
statement {
50+
effect = "Allow"
51+
principals {
52+
type = "AWS"
53+
identifiers = [var.kms_cross_account_iam_role_arn != null ? var.kms_cross_account_iam_role_arn : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
54+
}
55+
actions = ["kms:DescribeKey", "kms:GetPublicKey", "kms:Sign", "kms:Verify"]
56+
resources = ["*"]
57+
}
58+
}
59+
60+
# ************
61+
# AWS External KMS Key for Ethereum TxSender
62+
# ************
63+
64+
resource "aws_kms_external_key" "tx_sender" {
65+
count = var.kms_use_cross_account_kms_key ? 0 : 1
66+
description = "Application ${var.app_name} tx sender key for ${var.cluster_name}"
67+
key_usage = var.kms_key_usage
68+
key_spec = var.kms_key_spec
69+
deletion_window_in_days = var.kms_deletion_window_in_days
70+
tags = var.tags
71+
policy = data.aws_iam_policy_document.tx_sender_policy.json
72+
}
73+
74+
# ************
75+
# KMS Key Alias for Application Ethereum TxSender Key
76+
# ************
77+
resource "aws_kms_alias" "tx_sender" {
78+
count = var.kms_use_cross_account_kms_key ? 0 : 1
79+
80+
name = "alias/${var.app_name}-${var.cluster_name}"
81+
target_key_id = aws_kms_external_key.tx_sender[0].id
82+
}
83+
84+
resource "aws_iam_policy" "app_kms_policy" {
85+
count = var.kms_use_cross_account_kms_key ? 0 : 1
86+
87+
name = "${var.app_name}-${var.cluster_name}"
88+
policy = jsonencode({
89+
Version = "2012-10-17"
90+
Statement = [
91+
{
92+
Sid = "AllowPauserJobToUseKeyForEthereumTxSender"
93+
Effect = "Allow",
94+
Action = [
95+
"kms:DescribeKey",
96+
"kms:GetPublicKey",
97+
"kms:Sign",
98+
"kms:Verify"
99+
],
100+
Resource = aws_kms_external_key.tx_sender[0].arn
101+
},
102+
]
103+
})
104+
}
105+
106+
module "iam_assumable_role_tx_sender" {
107+
count = var.zama_protocol_pauser_iam_assumable_role_enabled ? 1 : 0
108+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
109+
version = "5.48.0"
110+
provider_url = data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer
111+
create_role = true
112+
role_name = "${var.app_name}-${var.cluster_name}"
113+
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.k8s_namespace}:${var.k8s_service_account_name}"]
114+
role_policy_arns = [aws_iam_policy.app_kms_policy[0].arn]
115+
}
116+
117+
resource "kubernetes_service_account" "tx_sender_irsa" {
118+
count = var.zama_protocol_pauser_iam_assumable_role_enabled && var.k8s_service_account_create ? 1 : 0
119+
metadata {
120+
name = var.k8s_service_account_name
121+
namespace = var.k8s_namespace
122+
annotations = {
123+
"eks.amazonaws.com/role-arn" = module.iam_assumable_role_tx_sender[0].iam_role_arn
124+
}
125+
}
126+
}
127+
128+
locals {
129+
kms_key_id = var.kms_use_cross_account_kms_key ? var.kms_cross_account_kms_key_id : aws_kms_external_key.tx_sender[0].id
130+
}
131+
132+
resource "kubernetes_config_map" "mpc_party_config" {
133+
count = var.k8s_config_map_create ? 1 : 0
134+
135+
metadata {
136+
name = var.k8s_config_map_name
137+
namespace = var.k8s_namespace
138+
139+
labels = {
140+
"app.kubernetes.io/name" = var.app_name
141+
"app.kubernetes.io/component" = "config"
142+
"app.kubernetes.io/managed-by" = "terraform"
143+
}
144+
145+
annotations = {
146+
"terraform.io/module" = "zama-protocol-pauser-wallet"
147+
}
148+
}
149+
150+
data = {
151+
"AWS_KMS_KEY_ID" = local.kms_key_id
152+
}
153+
154+
depends_on = [kubernetes_namespace.zama_protocol_namespace]
155+
}

‎modules/zama-protocol-pauser-wallet/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "aws_kms_key_id" {
2+
description = "Summary of the KMS Key for the application"
3+
value = local.kms_key_id
4+
}

‎modules/zama-protocol-pauser-wallet/variables.tf‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# ************
2+
# General variables
3+
# ************
4+
variable "tags" {
5+
type = map(string)
6+
description = "The tags for the KMS keys"
7+
}
8+
9+
# ************
10+
# Variables for usage in kms-for-mpc-party.tf
11+
# ************
12+
13+
variable "cluster_name" {
14+
type = string
15+
description = "Name of the cluster"
16+
default = null
17+
}
18+
19+
variable "app_name" {
20+
type = string
21+
description = "Name of the role"
22+
default = "zama-protocol-pause"
23+
}
24+
25+
variable "k8s_config_map_name" {
26+
type = string
27+
description = "Name of the configmap"
28+
default = "zama-protocol-pause"
29+
}
30+
31+
variable "k8s_config_map_create" {
32+
type = bool
33+
description = "Whether to create the configmap for that holds AWS_KMS_KEY_ID"
34+
default = true
35+
}
36+
37+
variable "k8s_service_account_name" {
38+
type = string
39+
description = "Name of the service account"
40+
default = "zama-protocol-pause"
41+
}
42+
43+
variable "k8s_service_account_create" {
44+
type = bool
45+
description = "Whether to create the service account for the KMS key"
46+
default = true
47+
}
48+
49+
variable "k8s_namespace" {
50+
type = string
51+
description = "Namespace of the application"
52+
default = "zama-protocol"
53+
}
54+
55+
variable "k8s_create_namespace" {
56+
description = "Whether to create the namespace if it doesn't exist"
57+
type = bool
58+
default = false
59+
}
60+
61+
variable "zama_protocol_pauser_iam_assumable_role_enabled" {
62+
type = bool
63+
description = "Whether to enable the IAM assumable role for the application"
64+
default = false
65+
}
66+
67+
variable "kms_cross_account_iam_role_arn" {
68+
type = string
69+
description = "ARN of cross-account IAM role allowed for usage of KMS key"
70+
default = null
71+
}
72+
73+
variable "kms_key_usage" {
74+
type = string
75+
description = "Key usage for txsender"
76+
default = "SIGN_VERIFY"
77+
}
78+
79+
variable "kms_key_spec" {
80+
description = "Specification for the txsender (e.g., ECC_SECG_P256K1 for Ethereum key signing)"
81+
type = string
82+
default = "ECC_SECG_P256K1"
83+
}
84+
85+
variable "kms_deletion_window_in_days" {
86+
type = number
87+
description = "Deletion window in days for KMS key"
88+
default = 30
89+
}
90+
91+
variable "kms_use_cross_account_kms_key" {
92+
type = bool
93+
description = "Whether a KMS key has been created in a different AWS account"
94+
default = false
95+
}
96+
97+
variable "kms_cross_account_kms_key_id" {
98+
type = string
99+
description = "KMS key ID of KMS key created in a different AWS account"
100+
default = ""
101+
}

‎modules/zama-protocol-pauser-wallet/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 6.0"
8+
}
9+
kubernetes = {
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.23"
12+
}
13+
}
14+
}

0 commit comments

Comments
 (0)