feat: s3 kms improvements

* added policy to lambda to use kms key * specify encryption on s3 upload
philips-labs · Apr 7, 2022 · f9ec111 · f9ec111
1 parent e023e7a
commit f9ec111
Show file tree

Hide file tree

Showing 4 changed files with 62 additions and 3 deletions.
diff --git a/modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/src/syncer/syncer.ts b/modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/src/syncer/syncer.ts
@@ -1,6 +1,5 @@
 import { Octokit } from '@octokit/rest';
-import { S3 } from 'aws-sdk';
-import AWS from 'aws-sdk';
+import AWS, { S3 } from 'aws-sdk';
 import axios from 'axios';
 import { PassThrough } from 'stream';
 
@@ -78,6 +77,8 @@ async function uploadToS3(s3: S3, cacheObject: CacheObject, actionRunnerReleaseA
       Key: cacheObject.key,
       Tagging: versionKey + '=' + actionRunnerReleaseAsset.name,
       Body: writeStream,
+      ServerSideEncryption: process.env.S3_SSE_ALGORITHM,
+      SSEKMSKeyId: process.env.S3_SSE_KMS_KEY_ID,
     })
     .promise();
 

diff --git a/modules/runner-binaries-syncer/main.tf b/modules/runner-binaries-syncer/main.tf
@@ -32,7 +32,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "bucket-config" {
 resource "aws_s3_bucket_server_side_encryption_configuration" "action_dist" {
   bucket = aws_s3_bucket.action_dist.id
 
-  count = length(keys(lookup(var.server_side_encryption_configuration, "rule", {}))) == 0 ? 0 : 1
+  count = try(var.server_side_encryption_configuration, null) != null ? 1 : 0
 
   rule {
     bucket_key_enabled = lookup(var.server_side_encryption_configuration.rule, "bucket_key_enabled", null)
@@ -56,3 +56,39 @@ resource "aws_s3_bucket_public_access_block" "action_dist" {
   ignore_public_acls      = true
   restrict_public_buckets = true
 }
+
+data "aws_iam_policy_document" "action_dist_sse_policy" {
+  count = try(var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default, null) != null ? 1 : 0
+
+  statement {
+    effect = "Deny"
+
+    principals {
+      type = "AWS"
+
+      identifiers = [
+        "*",
+      ]
+    }
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.action_dist.arn}/*",
+    ]
+
+    condition {
+      test     = "StringNotEquals"
+      variable = "s3:x-amz-server-side-encryption"
+      values   = [var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "action_dist_sse_policy" {
+  count  = try(var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default, null) != null ? 1 : 0
+  bucket = aws_s3_bucket.action_dist.id
+  policy = data.aws_iam_policy_document.action_dist_sse_policy[0].json
+}
diff --git a/modules/runner-binaries-syncer/policies/lambda-kms.json b/modules/runner-binaries-syncer/policies/lambda-kms.json
@@ -0,0 +1,10 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
+      "Resource": "${kms_key_arn}"
+    }
+  ]
+}
diff --git a/modules/runner-binaries-syncer/runner-binaries-syncer.tf b/modules/runner-binaries-syncer/runner-binaries-syncer.tf
@@ -29,6 +29,8 @@ resource "aws_lambda_function" "syncer" {
       LOG_TYPE                                = var.log_type
       S3_BUCKET_NAME                          = aws_s3_bucket.action_dist.id
       S3_OBJECT_KEY                           = local.action_runner_distribution_object_key
+      S3_SSE_ALGORITHM                        = try(var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm, null)
+      S3_SSE_KMS_KEY_ID                       = try(var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id, null)
     }
   }
   dynamic "vpc_config" {
@@ -87,6 +89,16 @@ resource "aws_iam_role_policy" "lambda_logging" {
   })
 }
 
+resource "aws_iam_role_policy" "lambda_kms" {
+  count = try(var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id, null) != null ? 1 : 0
+  name  = "${var.environment}-lambda-kms-policy-syncer"
+  role  = aws_iam_role.syncer_lambda.id
+
+  policy = templatefile("${path.module}/policies/lambda-kms.json", {
+    kms_key_arn = var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id
+  })
+}
+
 resource "aws_iam_role_policy" "syncer" {
   name = "${var.environment}-lambda-syncer-s3-policy"
   role = aws_iam_role.syncer_lambda.id