Add kms_master_key_id to alarm baseline and config-baseline module

[willfarrell]

Building onto of the great work by @mknapcok in PR #182. As mentioned in the other PR, I think this is as far as we can go till multi-region kms is supported.

Not sure where you'd like the example on how to use this addition

resource "aws_kms_key" "integrations" {
  description = "Operations: Default KMS key for SNS, SQS"
  deletion_window_in_days = 30
  enable_key_rotation = "true"

  policy = data.aws_iam_policy_document.kms-integrations.json
}

data "aws_iam_policy_document" "kms-integrations" {
  policy_id = "Operations: Default KMS key for SNS, SQS"

  statement {
    sid = "ChangePolicyAccess"

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
      ]
    }
    actions = [
      "kms:*"]
    resources = [
      "*"]
  }

  statement {
    # https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html#sns-what-permissions-for-sse
    sid = "AllowAWSServices"

    principals {
      type = "Service"
      identifiers = [
        "cloudwatch.amazonaws.com",
        "config.amazonaws.com",
      ]
    }
    actions = [
      "kms:GenerateDataKey*",
      "kms:Decrypt"
    ]
    resources = [
      "*"]
  }
}

Closes #163

[lorengordon]

fwiw, kms encryption support for config was just merged yesterday. should be available in the release this coming thursday!

• AWS ConfigService KMS encryption support hashicorp/terraform-provider-aws#20800

[nozaq]

@willfarrell Thank you, this looks a good intermediary approach until the multi-region key is supported in the upstream.
Let's merge this for now and come back here later when the upstream issue gets resolved!

[willfarrell]

Sounds good

[pperzyna]

@nozaq Could you create the next version 0.29.0 with those changes?

[nozaq]

@pperzyna Just published v0.29.0 👍🏼

[KnupMan]

@nozaq This was a breaking change, right? Just want to ensure that it's expected now always set sns_topic_kms_master_key_id variable.

[nozaq]

@KnupMan Thanks for the heads up. It didn't break anything in my environment during my test, but let me check again.

[nozaq]

@KnupMan Ah, you're right. sns_topic_kms_master_key_id should have a default value of null to be kept as optional. I'm gonna create a PR to fix it.

[nozaq]

The fix has been merged and published as v0.29.1.
Thanks @KnupMan for finding it out!