Add kms to eks cloudwatch log group

[bcarranza]

What does this do?

• Create a new module called kms/cloudwatch_log_group:

  kubernetes-ops/terraform-modules/aws/eks/main.tf

  Lines 35 to 39 in 571db96

  	module "kms_cloudwatch_log_group" {
  	source = "github.com/ManagedKube/kubernetes-ops.git//terraform-modules/aws/kms/cloudwatch_log_group?ref=feat-kms-eks-cloud-watch"
  	log_group_name = "/aws/eks/${var.cluster_name}/cluster"
  	tags = var.tags
  	}

• This module is consuming by eks to asociate an standard kms for log groups.
• One of the advantages is that this module can be used for future components that need cloudwatch log groups and wish to associate a kms that will free them from vulnerabilities.

Terraform plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.eks.aws_cloudwatch_log_group.this[0] will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "this" {
        id                = "/aws/eks/ops/cluster"
      + kms_key_id        = (known after apply)
        name              = "/aws/eks/ops/cluster"
        tags              = {
            "ops_env"              = "ops"
            "ops_managed_by"       = "terraform"
            "ops_owners"           = "devops"
            "ops_source_repo"      = "gruntwork-infrastructure-live"
            "ops_source_repo_path" = "ops/us-west-2/ops/p2a/0200-eks"
        }
        # (3 unchanged attributes hidden)
    }

  # module.kms_cloudwatch_log_group.aws_kms_key.kms will be created
  + resource "aws_kms_key" "kms" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 10
      + description                        = "KMS key for log-group: /aws/eks/ops/cluster"
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "kms:Update*",
                          + "kms:Untag*",
                          + "kms:Tag*",
                          + "kms:ScheduleKeyDeletion",
                          + "kms:Revoke*",
                          + "kms:Put*",
                          + "kms:List*",
                          + "kms:Get*",
                          + "kms:Enable*",
                          + "kms:Disable*",
                          + "kms:Describe*",
                          + "kms:Delete*",
                          + "kms:Create*",
                          + "kms:CancelKeyDeletion",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::xxxxxx:root"
                        }
                      + Resource  = "*"
                      + Sid       = "Enable Root User Permissions"
                    },
                  + {
                      + Action    = [
                          + "kms:ReEncrypt*",
                          + "kms:GenerateDataKey*",
                          + "kms:Encrypt*",
                          + "kms:Describe*",
                          + "kms:Decrypt*",
                        ]
                      + Condition = {
                          + ArnEquals = {
                              + kms:EncryptionContext:aws:logs:arn = "arn:aws:logs:us-west-2:xxxxxx:log-group:/aws/eks/ops/cluster"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "logs.us-west-2.amazonaws.com"
                        }
                      + Resource  = "*"
                      + Sid       = "Allow KMS to CloudWatch Log Group /aws/eks/ops/cluster"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + tags                               = {
          + "ops_env"              = "ops"
          + "ops_managed_by"       = "terraform"
          + "ops_owners"           = "devops"
          + "ops_source_repo"      = "gruntwork-infrastructure-live"
          + "ops_source_repo_path" = "ops/us-west-2/ops/p2a/0200-eks"
        }
      + tags_all                           = {
          + "ops_env"              = "ops"
          + "ops_managed_by"       = "terraform"
          + "ops_owners"           = "devops"
          + "ops_source_repo"      = "gruntwork-infrastructure-live"
          + "ops_source_repo_path" = "ops/us-west-2/ops/p2a/0200-eks"
        }
    }

Plan: 1 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
Releasing state lock. This may take a few moments...

Evidence in aws console