Common-Keys.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Common-Keys Template.
  This creates KMS Keys which should exist in every Region. These keys are used to encrypt various services.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Dependencies
        Parameters:
          - CodesStackName
      - Label:
          default: System Configuration
        Parameters:
          - CompanyName
          - SystemName
      - Label:
          default: Environment Configuration
        Parameters:
          - AccountName
          - EnvironmentName
      - Label:
          default: Key Configuration
        Parameters:
          - UseSystemCodeInAliasName
          - UseEnvironmentNameInAliasName
          - UseDynamoDBKey
          - UseEBSKey
          - UseElasticFilesystemKey
          - UseESKey
          - UseGlueKey
          - UseRDSKey
          - UseRedShiftKey
          - UseS3Key
          - UseSecretsManagerKey
          - UseSSMKey
    ParameterLabels:
      CodesStackName:
        default: Codes Stack Name
      CompanyName:
        default: Company Name
      SystemName:
        default: System Name
      AccountName:
        default: Account Name
      EnvironmentName:
        default: Environment Name
      UseSystemCodeInAliasName:
        default: Use System Code in AliasName
      UseEnvironmentNameInAliasName:
        default: Use Environment Name in AliasName
      UseDynamoDBKey:
        default: Use DynamoDB Key
      UseEBSKey:
        default: Use EBS Key
      UseElasticFilesystemKey:
        default: Use ElasticFilesystem Key
      UseESKey:
        default: Use ElasticSearch Key
      UseGlueKey:
        default: Use Glue Key
      UseRDSKey:
        default: Use RDS Key
      UseRedShiftKey:
        default: Use RedShift Key
      UseS3Key:
        default: Use S3 Key
      UseSecretsManagerKey:
        default: Use SecretsManager Key
      UseSSMKey:
        default: Use SSM Key
Parameters:
  CodesStackName:
    Description: Name of the CloudFormation Stack containing Codes Resources
    Type: String
    MinLength: 2
    MaxLength: 64
    Default: Codes
    AllowedPattern: ^[A-Z][-a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters and dashes.
  CompanyName:
    Description: Name of the Company associated with the Stack
    Type: String
    MinLength: 2
    MaxLength: 32
    Default: DXC
    AllowedPattern: ^[A-Z][a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters.
  SystemName:
    Description: Name of the System associated with the Stack
    Type: String
    MinLength: 2
    MaxLength: 32
    Default: Prototype
    AllowedPattern: ^[A-Z][a-zA-Z0-9]*$
    ConstraintDescription: must begin with an upper case letter and contain alphanumeric characters.
  AccountName:
    Description: Name of the Account associated with the Stack
    Type: String
    Default: Production
    AllowedValues:
      - Production
      - Staging
      - UAT
      - QA
      - Testing
      - Development
      - Build
      - Core
      - Recovery
      - Log
      - Management
      - Jumpstart
      - Organization
    ConstraintDescription: must be Production, Staging, UAT, QA, Testing, Development, Build, Core, Recovery, Log, Management, Jumpstart or Organization.
  EnvironmentName:
    Description: Name of the Environment associated with the Stack
    Type: String
    Default: Production
    AllowedValues:
      - Production
      - Staging
      - UAT
      - QA
      - Testing
      - Development
      - Build
      - Core
      - Recovery
      - Log
      - Identity
      - Management
      - Organization
    ConstraintDescription: must be Production, Staging, UAT, QA, Testing, Development, Build, Core, Recovery, Log, Identity, Management or Organization.
  UseSystemCodeInAliasName:
    Description: Include a System Code in the Alias
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseEnvironmentNameInAliasName:
    Description: Include an Environment Name in the Alias
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseDynamoDBKey:
    Description: Create a Key for use by DynamoDB
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseEBSKey:
    Description: Create a Key for use by EBS
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseElasticFilesystemKey:
    Description: Create a Key for use by ElasticFilesystem
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseESKey:
    Description: Create a Key for use by ElasticSearch
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseGlueKey:
    Description: Create a Key for use by Glue
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseRDSKey:
    Description: Create a Key for use by RDS
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseRedShiftKey:
    Description: Create a Key for use by RedShift
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseS3Key:
    Description: Create a Key for use by S3
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseSecretsManagerKey:
    Description: Create a Key for use by SecretsManager
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
  UseSSMKey:
    Description: Create a Key for use by SSM
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    ConstraintDescription: must be either true or false.
Conditions:
  ConfigureAccountEnvironment: !Or [ !Not [ !Equals [ !Ref AccountName, !Ref EnvironmentName ]], !Equals [ !Ref AccountName, Jumpstart ]]
  ConfigureAliasNameSystemCode: !Equals [ !Ref UseSystemCodeInAliasName, true ]
  ConfigureAliasNameEnvironmentName: !Or [ !Condition ConfigureAccountEnvironment, !Equals [ !Ref UseEnvironmentNameInAliasName, true ]]
  ConfigureDynamoDBKey: !Equals [ !Ref UseDynamoDBKey, true ]
  ConfigureEBSKey: !Equals [ !Ref UseEBSKey, true ]
  ConfigureElasticFilesystemKey: !Equals [ !Ref UseElasticFilesystemKey, true ]
  ConfigureESKey: !Equals [ !Ref UseESKey, true ]
  ConfigureGlueKey: !Equals [ !Ref UseGlueKey, true ]
  ConfigureRDSKey: !Equals [ !Ref UseRDSKey, true ]
  ConfigureRedShiftKey: !Equals [ !Ref UseRedShiftKey, true ]
  ConfigureS3Key: !Equals [ !Ref UseS3Key, true ]
  ConfigureSecretsManagerKey: !Equals [ !Ref UseSecretsManagerKey, true ]
  ConfigureSSMKey: !Equals [ !Ref UseSSMKey, true ]
Resources:
  DynamoDBKey:
    Type: AWS::KMS::Key
    Properties:
      Description: DynamoDB Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-DynamoDBKey
    Condition: ConfigureDynamoDBKey
  DynamoDBAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: dynamodb
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureDynamoDBKey
  DynamoDBAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${DynamoDBAliasName}
      TargetKeyId: !GetAtt DynamoDBKey.Arn
    Condition: ConfigureDynamoDBKey
  EBSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: EBS Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EBSKey
    Condition: ConfigureEBSKey
  EBSAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: ebs
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureEBSKey
  EBSAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${EBSAliasName}
      TargetKeyId: !GetAtt EBSKey.Arn
    Condition: ConfigureEBSKey
  ElasticFilesystemKey:
    Type: AWS::KMS::Key
    Properties:
      Description: ElasticFilesystem Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-ElasticFilesystemKey
    Condition: ConfigureElasticFilesystemKey
  ElasticFilesystemAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: elasticfilesystem
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureElasticFilesystemKey
  ElasticFilesystemAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${ElasticFilesystemAliasName}
      TargetKeyId: !GetAtt ElasticFilesystemKey.Arn
    Condition: ConfigureElasticFilesystemKey
  ESKey:
    Type: AWS::KMS::Key
    Properties:
      Description: ES Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-ESKey
    Condition: ConfigureESKey
  ESAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: es
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureESKey
  ESAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${ESAliasName}
      TargetKeyId: !GetAtt ESKey.Arn
    Condition: ConfigureESKey
  GlueKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Glue Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-GlueKey
    Condition: ConfigureGlueKey
  GlueAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: glue
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureGlueKey
  GlueAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${GlueAliasName}
      TargetKeyId: !GetAtt GlueKey.Arn
    Condition: ConfigureGlueKey
  RDSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: RDS Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-RDSKey
    Condition: ConfigureRDSKey
  RDSAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: rds
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureRDSKey
  RDSAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${RDSAliasName}
      TargetKeyId: !GetAtt RDSKey.Arn
    Condition: ConfigureRDSKey
  RedShiftKey:
    Type: AWS::KMS::Key
    Properties:
      Description: RedShift Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-RedShiftKey
    Condition: ConfigureRedShiftKey
  RedShiftAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: redshift
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureRedShiftKey
  RedShiftAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${RedShiftAliasName}
      TargetKeyId: !GetAtt RedShiftKey.Arn
    Condition: ConfigureRedShiftKey
  S3Key:
    Type: AWS::KMS::Key
    Properties:
      Description: S3 Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-S3Key
    Condition: ConfigureS3Key
  S3AliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: s3
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureS3Key
  S3Alias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${S3AliasName}
      TargetKeyId: !GetAtt S3Key.Arn
    Condition: ConfigureS3Key
  SecretsManagerKey:
    Type: AWS::KMS::Key
    Properties:
      Description: SecretsManager Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-SecretsManagerKey
    Condition: ConfigureSecretsManagerKey
  SecretsManagerAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: secretsmanager
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureSecretsManagerKey
  SecretsManagerAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${SecretsManagerAliasName}
      TargetKeyId: !GetAtt SecretsManagerKey.Arn
    Condition: ConfigureSecretsManagerKey
  SSMKey:
    Type: AWS::KMS::Key
    Properties:
      Description: SSM Key
      Enabled: true
      EnableKeyRotation: false
      KeyPolicy:
        Version: 2012-10-17
        Id: AllowIAMUserPermissions
        Statement:
          - Sid: EnableIAMUserPermissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:*
            Resource: '*'
          - Sid: AllowKeyAdministration
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
            Resource: '*'
          - Sid: AllowKeyUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/administrator
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-SSMKey
    Condition: ConfigureSSMKey
  SSMAliasName:
    Type: Custom::AliasName
    Properties:
      ServiceToken: !ImportValue
        Fn::Sub: ${CodesStackName}-AliasNameFunctionArn
      CompanyName: !Ref CompanyName
      SystemName: !If [ ConfigureAliasNameSystemCode, !Ref SystemName, !Ref 'AWS::NoValue' ]
      ServiceName: ssm
      EnvironmentName: !If [ ConfigureAliasNameEnvironmentName, !Ref EnvironmentName, !Ref 'AWS::NoValue' ]
    Condition: ConfigureSSMKey
  SSMAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${SSMAliasName}
      TargetKeyId: !GetAtt SSMKey.Arn
    Condition: ConfigureSSMKey
Outputs:
  DynamoDBKey:
    Description: The DynamoDB Key
    Value: !Ref DynamoDBKey
    Export:
      Name: !Sub ${AWS::StackName}-DynamoDBKey
    Condition: ConfigureDynamoDBKey
  DynamoDBAlias:
    Description: The DynamoDB Alias
    Value: !Ref DynamoDBAlias
    Export:
      Name: !Sub ${AWS::StackName}-DynamoDBAlias
    Condition: ConfigureDynamoDBKey
  EBSKey:
    Description: The EBS Key
    Value: !Ref EBSKey
    Export:
      Name: !Sub ${AWS::StackName}-EBSKey
    Condition: ConfigureEBSKey
  EBSAlias:
    Description: The EBS Alias
    Value: !Ref EBSAlias
    Export:
      Name: !Sub ${AWS::StackName}-EBSAlias
    Condition: ConfigureEBSKey
  ElasticFilesystemKey:
    Description: The ElasticFilesystem Key
    Value: !Ref ElasticFilesystemKey
    Export:
      Name: !Sub ${AWS::StackName}-ElasticFilesystemKey
    Condition: ConfigureElasticFilesystemKey
  ElasticFilesystemAlias:
    Description: The ElasticFilesystem Alias
    Value: !Ref ElasticFilesystemAlias
    Export:
      Name: !Sub ${AWS::StackName}-ElasticFilesystemAlias
    Condition: ConfigureElasticFilesystemKey
  ESKey:
    Description: The ES Key
    Value: !Ref ESKey
    Export:
      Name: !Sub ${AWS::StackName}-ESKey
    Condition: ConfigureESKey
  ESAlias:
    Description: The ES Alias
    Value: !Ref ESAlias
    Export:
      Name: !Sub ${AWS::StackName}-ESAlias
    Condition: ConfigureESKey
  GlueKey:
    Description: The Glue Key
    Value: !Ref GlueKey
    Export:
      Name: !Sub ${AWS::StackName}-GlueKey
    Condition: ConfigureGlueKey
  GlueAlias:
    Description: The Glue Alias
    Value: !Ref GlueAlias
    Export:
      Name: !Sub ${AWS::StackName}-GlueAlias
    Condition: ConfigureGlueKey
  RDSKey:
    Description: The RDS Key
    Value: !Ref RDSKey
    Export:
      Name: !Sub ${AWS::StackName}-RDSKey
    Condition: ConfigureRDSKey
  RDSAlias:
    Description: The RDS Alias
    Value: !Ref RDSAlias
    Export:
      Name: !Sub ${AWS::StackName}-RDSAlias
    Condition: ConfigureRDSKey
  RedShiftKey:
    Description: The RedShift Key
    Value: !Ref RedShiftKey
    Export:
      Name: !Sub ${AWS::StackName}-RedShiftKey
    Condition: ConfigureRedShiftKey
  RedShiftAlias:
    Description: The RedShift Alias
    Value: !Ref RedShiftAlias
    Export:
      Name: !Sub ${AWS::StackName}-RedShiftAlias
    Condition: ConfigureRedShiftKey
  S3Key:
    Description: The S3 Key
    Value: !Ref S3Key
    Export:
      Name: !Sub ${AWS::StackName}-S3Key
    Condition: ConfigureS3Key
  S3Alias:
    Description: The S3 Alias
    Value: !Ref S3Alias
    Export:
      Name: !Sub ${AWS::StackName}-S3Alias
    Condition: ConfigureS3Key
  SecretsManagerKey:
    Description: The SecretsManager Key
    Value: !Ref SecretsManagerKey
    Export:
      Name: !Sub ${AWS::StackName}-SecretsManagerKey
    Condition: ConfigureSecretsManagerKey
  SecretsManagerAlias:
    Description: The SecretsManager Alias
    Value: !Ref SecretsManagerAlias
    Export:
      Name: !Sub ${AWS::StackName}-SecretsManagerAlias
    Condition: ConfigureSecretsManagerKey
  SSMKey:
    Description: The SSM Key
    Value: !Ref SSMKey
    Export:
      Name: !Sub ${AWS::StackName}-SSMKey
    Condition: ConfigureSSMKey
  SSMAlias:
    Description: The SSM Alias
    Value: !Ref SSMAlias
    Export:
      Name: !Sub ${AWS::StackName}-SSMAlias
    Condition: ConfigureSSMKey