EReropple·Aug 22, 2016
My policies are automated. I wrote the automation. :) And thank you for the compliment, but I wouldn't call myself "elite", merely "pretty good". Seriously, this is literally all it is:
def kms_read_policy(contexts)
contexts.map do |context|
{
PolicyName: "kms-read",
PolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: 'kms:Decrypt' ,
Resource: [
Cfer.cfize('arn:aws:kms:C{AWS.region}:' \
'C{AWS.account_id}:key/C{Fn.ref(:CredstashKey)}')
],
Condition: {
StringEquals:
context.map do |k, v|
[ "kms:EncryptionContext:#{k}", v ]
end.to_h
}
Read the rest
}
]
}
}
end.to_a
end
And a single DynamoDB policy in a managed policy that allows for querying the `credential-store` table. This just is not rocket science. It's helped by cfer[0] and cfer-provisioning[1] being pretty great, but it's very achievable.
[0] - https://github.com/seanedwards/cfer
[1] - https://github.com/seanedwards/cfer-provisioning (I'm a maintainer)