FredsCloudMonitor/sample/kms.tf

# Because we use encryption for SNS and SQS, we need a customer managed CMK
# with appropriate access. We'll use one key for everything.
resource "aws_kms_key" "FCM-Key" {
    description             = "FCM-Key"
    deletion_window_in_days = 7 #Might want to increase this for production use
    enable_key_rotation     = true

    policy = <<POLICY
    {
			"Version": "2012-10-17",
			"Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::082012130604:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
				{
					"Sid": "Allow Amazon Services to use this key",
					"Effect": "Allow",
					"Principal": {
						"Service": "sns.amazonaws.com"
					},
					"Action": [
						"kms:Decrypt",
						"kms:GenerateDataKey*"
					],
					"Resource": "*"
				},
				{
					"Sid": "Allow CloudWatch Events to use this key",
					"Effect": "Allow",
					"Principal": {
						"Service": "events.amazonaws.com"
					},
          "Action": "kms:*",
					"Resource": "*"
				},
				{
					"Sid": "Grant access to lambda functions",
					"Effect": "Allow",
					"Principal": {
            "AWS": "${aws_iam_role.fcm-analysis-EbsEncryptionByDefault.arn}"
					},
					"Action": [
            "kms:GenerateDataKey*",
            "kms:Decrypt"
          ],
					"Resource": "*"
				}
			]
    }
    POLICY
    tags = {
        Project = "FredsCloudMonitor"
    }
}

resource "aws_kms_alias" "FCM-Key" {
  name = "alias/fcm"
  target_key_id = "${aws_kms_key.FCM-Key.key_id}"
}