fix: KMS least privileged access (#139)

lacework · Jul 14, 2023 · 4e004b7 · 4e004b7
1 parent 013ef59
commit 4e004b7
Showing 1 changed file with 2 additions and 8 deletions.
diff --git a/main.tf b/main.tf
@@ -182,7 +182,7 @@ data "aws_iam_policy_document" "cloudtrail_log_policy" {
 
     principals {
       type        = "AWS"
-      identifiers = ["*"]
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
 
     condition {
@@ -356,7 +356,7 @@ data "aws_iam_policy_document" "kms_key_policy" {
 
     principals {
       type        = "AWS"
-      identifiers = ["*"]
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
 
     actions = [
@@ -365,12 +365,6 @@ data "aws_iam_policy_document" "kms_key_policy" {
     ]
     resources = ["*"]
 
-    condition {
-      test     = "StringEquals"
-      variable = "kms:CallerAccount"
-      values   = [data.aws_caller_identity.current.account_id]
-    }
-
     condition {
       test     = "StringLike"
       variable = "kms:EncryptionContext:aws:cloudtrail:arn"