terraform-module-aws-virtual-machine/kms.tf

####
# KMS
####

locals {
  should_create_kms_key          = var.volume_kms_key_create && (var.root_block_device_encrypted || var.extra_volume_count > 0)
  should_grant_asg_to_access_key = var.root_block_device_encrypted && var.use_autoscaling_group && (var.volume_kms_key_external_exist || local.should_create_kms_key)

  volume_kms_key_arn = local.should_create_kms_key ? aws_kms_key.this_volume.*.arn[0] : var.volume_kms_key_arn
}

resource "aws_kms_key" "this_volume" {
  count = local.should_create_kms_key ? 1 : 0

  description              = "KMS key for ${format("%s%s", var.prefix, var.name)} instance(s) volume(s)."
  customer_master_key_spec = var.volume_kms_key_customer_master_key_spec
  policy                   = var.volume_kms_key_policy


  tags = merge(
    {
      "Name" = format("%s%s", var.prefix, var.volume_kms_key_name)
    },
    var.tags,
    var.volume_kms_key_tags,
    local.tags,
  )
}

resource "aws_kms_alias" "this_volume" {
  count = local.should_create_kms_key ? 1 : 0

  name          = format("alias/%s%s", var.prefix, var.volume_kms_key_alias)
  target_key_id = aws_kms_key.this_volume[0].key_id
}

resource "aws_kms_grant" "this_volume" {
  count = local.should_grant_asg_to_access_key ? 1 : 0

  name              = "AllowASGToAccessKMS"
  key_id            = local.volume_kms_key_arn
  grantee_principal = aws_iam_service_linked_role.asg.*.arn[0]
  operations        = ["Encrypt", "Decrypt", "GenerateDataKey", "DescribeKey", "CreateGrant", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "RetireGrant"]
}