Add permission to use adhoc KMS key

planetarium · Aug 21, 2024 · c630bc8 · c630bc8
1 parent 7144483
commit c630bc8
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/worker/worker_cdk_stack.py b/worker/worker_cdk_stack.py
@@ -64,6 +64,14 @@ def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
                 resources=[f"arn:aws:kms:{config.region_name}:{config.account_id}:key/{kms_key_id}"]
             )
         )
+        resp = ssm.get_parameter(Name=f"{config.stage}_9c_IAP_ADHOC_KMS_KEY_ID", WithDecryption=True)
+        kms_key_id = resp["Parameter"]["Value"]
+        role.add_to_policy(
+            _iam.PolicyStatement(
+                actions=["kms:GetPublicKey", "kms:Sign"],
+                resources=[f"arn:aws:kms:{config.region_name}:{config.account_id}:key/{kms_key_id}"]
+            )
+        )
         role.add_to_policy(
             _iam.PolicyStatement(
                 actions=["ssm:GetParameter"],