fix: 🐛 Add conditional for dynamic KMS permission

StateFarmIns · Jun 19, 2023 · 4c939e5 · 4c939e5
1 parent 64dc3b0
commit 4c939e5
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/tf-lambda-iam-role.tf b/tf-lambda-iam-role.tf
@@ -40,9 +40,12 @@ data "aws_iam_policy_document" "log_retention" {
     }
   }
 
-  statement {
-    actions   = ["kms:GenerateDataKey"]
-    resources = [var.kms_key_arn]
+  dynamic "statement" {
+    for_each = var.kms_key_arn == null ? [] : [var.kms_key_arn]
+    content {
+      actions   = ["kms:GenerateDataKey"]
+      resources = [each.value]
+    }
   }
 
   statement {