PLAT-9123: Costs module non-kms mode (#329)

dominodatalab · Feb 7, 2025 · 698ad64 · 698ad64
1 parent 46578e4
commit 698ad64
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 8 deletions.
diff --git a/modules/iam-bootstrap/bootstrap-2.json b/modules/iam-bootstrap/bootstrap-2.json
@@ -20,7 +20,6 @@
       "Effect": "Allow",
       "Action": [
         "lambda:CreateFunction",
-        "lambda:TagResource",
         "lambda:GetFunction",
         "lambda:ListVersionsByFunction",
         "lambda:DeleteFunction",
@@ -42,7 +41,10 @@
         "lambda:UpdateCodeSigningConfig",
         "lambda:GetCodeSigningConfig",
         "lambda:GetFunctionCodeSigningConfig",
-        "lambda:DeleteCodeSigningConfig"
+        "lambda:DeleteCodeSigningConfig",
+        "lambda:TagResource",
+        "lambda:UntagResource",
+        "lambda:ListTags"
       ],
       "Resource": "*"
     },
@@ -60,7 +62,10 @@
       "Action": [
         "cur:PutReportDefinition",
         "cur:DescribeReportDefinitions",
-        "cur:DeleteReportDefinition"
+        "cur:DeleteReportDefinition",
+        "cur:TagResource",
+        "cur:UntagResource",
+        "cur:ListTagsForResource"
       ],
       "Resource": [
         "*"

diff --git a/modules/infra/submodules/cost-usage-report/glue.tf b/modules/infra/submodules/cost-usage-report/glue.tf
@@ -11,21 +11,22 @@ resource "aws_glue_catalog_database" "aws_cur_database" {
 
 
 resource "aws_glue_security_configuration" "lambda_config" {
+  # checkov:skip=CKV_AWS_99:Ensure Glue Security Configuration Encryption is enabled
   name = "${var.deploy_id}_lambda_security_config"
 
   encryption_configuration {
     cloudwatch_encryption {
-      cloudwatch_encryption_mode = "SSE-KMS"
+      cloudwatch_encryption_mode = var.kms_info.enabled ? "SSE-KMS" : "DISABLED"
       kms_key_arn                = local.kms_key_arn
     }
 
     job_bookmarks_encryption {
-      job_bookmarks_encryption_mode = "CSE-KMS"
+      job_bookmarks_encryption_mode = var.kms_info.enabled ? "CSE-KMS" : "DISABLED"
       kms_key_arn                   = local.kms_key_arn
     }
 
     s3_encryption {
-      s3_encryption_mode = "SSE-KMS"
+      s3_encryption_mode = var.kms_info.enabled ? "SSE-KMS" : "SSE-S3"
       kms_key_arn        = local.kms_key_arn
     }
   }
@@ -117,7 +118,7 @@ resource "aws_athena_workgroup" "athena_work_group" {
       output_location = "s3://${aws_s3_bucket.athena_result.bucket}/"
 
       encryption_configuration {
-        encryption_option = "SSE_KMS"
+        encryption_option = var.kms_info.enabled ? "SSE_KMS" : "SSE_S3"
         kms_key_arn       = local.kms_key_arn
       }
     }
@@ -137,4 +138,4 @@ resource "aws_vpc_endpoint" "aws_glue_vpc_endpoint" {
   tags = {
     "Name" = "${var.deploy_id}-glue"
   }
-}
+}