feat: add an IAM policy to grant the runner access to the KMS key

main.tf

@@ -370,6 +370,32 @@ resource "aws_iam_role" "instance" {
   tags = merge(local.tags, var.role_tags)
 }
 
+################################################################################
+### Policy for the instance to use the KMS key
+################################################################################
+resource "aws_iam_policy" "instance_kms_policy" {
+  count = var.enable_kms ? 1 : 0
+
+  name        = "${local.name_iam_objects}-kms"
+  path        = "/"
+  description = "Allow runner instance the ability to use the KMS key."
+  policy = templatefile("${path.module}/policies/instance-kms-policy.json",
+    {
+      kms_key_arn = var.enable_kms && var.kms_key_id == "" ? aws_kms_key.default[0].arn : "arn:aws:kms:${var.aws_region}:${data.aws_caller_identity.current.account_id}:key/${var.kms_key_id}"
+    }
+  )
+
+  tags = local.tags
+}
+
+resource "aws_iam_role_policy_attachment" "instance_kms_policy" {
+  count = var.enable_kms ? 1 : 0
+
+  role       = var.create_runner_iam_role ? aws_iam_role.instance[0].name : local.aws_iam_role_instance_name
+  policy_arn = aws_iam_policy.instance_kms_policy[0].arn
+}
+
+
 ################################################################################
 ### Policies for runner agent instance to create docker machines via spot req.
 ###
@@ -459,6 +485,8 @@ resource "aws_iam_role" "docker_machine" {
   tags = local.tags
 }
 
+
+
 resource "aws_iam_instance_profile" "docker_machine" {
   count = var.runners_executor == "docker+machine" ? 1 : 0
   name  = "${local.name_iam_objects}-docker-machine"
@@ -484,6 +512,8 @@ resource "aws_iam_role_policy_attachment" "docker_machine_session_manager_aws_ma
   policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonSSMManagedInstanceCore"
 }
 
+
+
 ################################################################################
 ### Service linked policy, optional
 ################################################################################

policies/instance-kms-policy.json

@@ -0,0 +1,18 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": [
+                "kms:Encrypt*",
+                "kms:Decrypt*",
+                "kms:ReEncrypt*",
+                "kms:GenerateDataKey*",
+                "kms:Describe*"
+            ],
+            "Effect": "Allow",
+            "Resource": [
+                "${kms_key_arn}"
+            ]
+        }
+    ]
+}