Skip to content

Commit 8122444

Browse files
magreenbaummagreenbaum
authored
feat: Support studio encryption_key_arn (#35)
1 parent ad34d3d commit 8122444

File tree

21 files changed

+112
-27
lines changed

21 files changed

+112
-27
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -330,13 +330,13 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module
330330
| Name | Version |
331331
|------|---------|
332332
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
333-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
333+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
334334

335335
## Providers
336336

337337
| Name | Version |
338338
|------|---------|
339-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
339+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
340340

341341
## Modules
342342

‎examples/private-cluster/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@ Note that this example may create resources which will incur monetary charges on
2828
| Name | Version |
2929
|------|---------|
3030
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
31-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
31+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
3232

3333
## Providers
3434

3535
| Name | Version |
3636
|------|---------|
37-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
37+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
3838

3939
## Modules
4040

‎examples/private-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎examples/public-cluster/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ Note that this example may create resources which will incur monetary charges on
2626
| Name | Version |
2727
|------|---------|
2828
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
29-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
29+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
3030

3131
## Providers
3232

3333
| Name | Version |
3434
|------|---------|
35-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
35+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
3636

3737
## Modules
3838

‎examples/public-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎examples/serverless-cluster/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ Note that this example may create resources which will incur monetary charges on
2626
| Name | Version |
2727
|------|---------|
2828
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
29-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
29+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
3030

3131
## Providers
3232

3333
| Name | Version |
3434
|------|---------|
35-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
35+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
3636

3737
## Modules
3838

‎examples/serverless-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎examples/studio/README.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ $ terraform apply
2222
| Name | Version |
2323
|------|---------|
2424
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
25-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
25+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
2626

2727
## Providers
2828

2929
| Name | Version |
3030
|------|---------|
31-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
31+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
3232

3333
## Modules
3434

@@ -38,6 +38,7 @@ $ terraform apply
3838
| <a name="module_emr_studio_disabled"></a> [emr\_studio\_disabled](#module\_emr\_studio\_disabled) | ../../modules/studio | n/a |
3939
| <a name="module_emr_studio_iam"></a> [emr\_studio\_iam](#module\_emr\_studio\_iam) | ../../modules/studio | n/a |
4040
| <a name="module_emr_studio_sso"></a> [emr\_studio\_sso](#module\_emr\_studio\_sso) | ../../modules/studio | n/a |
41+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 2.0 |
4142
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 4.0 |
4243
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
4344

@@ -46,7 +47,9 @@ $ terraform apply
4647
| Name | Type |
4748
|------|------|
4849
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
50+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
4951
| [aws_identitystore_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/identitystore_group) | data source |
52+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
5053
| [aws_ssoadmin_instances.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_instances) | data source |
5154

5255
## Inputs

‎examples/studio/main.tf

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ provider "aws" {
44

55
data "aws_availability_zones" "available" {}
66

7+
data "aws_caller_identity" "current" {}
8+
9+
data "aws_region" "current" {}
10+
711
locals {
812
name = replace(basename(path.cwd), "-cluster", "")
913
region = "eu-west-1"
@@ -139,6 +143,22 @@ module "emr_studio_iam" {
139143
vpc_id = module.vpc.vpc_id
140144
subnet_ids = module.vpc.private_subnets
141145

146+
encryption_key_arn = module.kms.key_arn
147+
148+
service_role_statements = [
149+
{
150+
effect = "Allow"
151+
actions = [
152+
"kms:Decrypt",
153+
"kms:GenerateDataKey",
154+
"kms:ReEncryptFrom",
155+
"kms:ReEncryptTo",
156+
"kms:DescribeKey"
157+
]
158+
resources = [module.kms.key_arn]
159+
}
160+
]
161+
142162
tags = local.tags
143163
}
144164

@@ -198,3 +218,57 @@ module "s3_bucket" {
198218

199219
tags = local.tags
200220
}
221+
222+
module "kms" {
223+
source = "terraform-aws-modules/kms/aws"
224+
version = "~> 2.0"
225+
226+
deletion_window_in_days = 7
227+
description = "KMS key for ${local.name}."
228+
enable_key_rotation = true
229+
is_enabled = true
230+
key_usage = "ENCRYPT_DECRYPT"
231+
enable_default_policy = true
232+
key_statements = [
233+
{
234+
sid = "EMRStudio"
235+
actions = [
236+
"kms:Decrypt",
237+
"kms:GenerateDataKey",
238+
"kms:ReEncryptFrom",
239+
"kms:ReEncryptTo",
240+
"kms:DescribeKey"
241+
]
242+
resources = ["*"]
243+
244+
principals = [
245+
{
246+
type = "AWS"
247+
identifiers = [module.emr_studio_iam.service_iam_role_arn]
248+
}
249+
]
250+
251+
conditions = [
252+
{
253+
test = "StringEquals"
254+
variable = "kms:CallerAccount"
255+
values = [data.aws_caller_identity.current.account_id]
256+
},
257+
{
258+
test = "StringEquals"
259+
variable = "kms:EncryptionContext:aws:s3:arn"
260+
values = [module.s3_bucket.s3_bucket_arn]
261+
},
262+
{
263+
test = "StringEquals"
264+
variable = "kms:ViaService"
265+
values = ["s3.${data.aws_region.current.name}.amazonaws.com"]
266+
}
267+
]
268+
}
269+
]
270+
271+
aliases = [local.name]
272+
273+
tags = local.tags
274+
}

‎examples/studio/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎examples/virtual-cluster/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ aws emr-containers list-virtual-clusters --region us-west-2 --states ARRESTED \
4545
| Name | Version |
4646
|------|---------|
4747
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
48-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
48+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
4949
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.17 |
5050
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
5151
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.7 |
@@ -54,7 +54,7 @@ aws emr-containers list-virtual-clusters --region us-west-2 --states ARRESTED \
5454

5555
| Name | Version |
5656
|------|---------|
57-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
57+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
5858
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
5959
| <a name="provider_time"></a> [time](#provider\_time) | >= 0.7 |
6060

‎examples/virtual-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
kubernetes = {
1010
source = "hashicorp/kubernetes"

‎modules/serverless/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,13 +134,13 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module
134134
| Name | Version |
135135
|------|---------|
136136
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
137-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
137+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
138138

139139
## Providers
140140

141141
| Name | Version |
142142
|------|---------|
143-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
143+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
144144

145145
## Modules
146146

‎modules/serverless/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎modules/studio/README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,13 +68,13 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module
6868
| Name | Version |
6969
|------|---------|
7070
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
71-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
71+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
7272

7373
## Providers
7474

7575
| Name | Version |
7676
|------|---------|
77-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
77+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
7878

7979
## Modules
8080

@@ -119,6 +119,7 @@ No modules.
119119
| <a name="input_create_user_role_policy"></a> [create\_user\_role\_policy](#input\_create\_user\_role\_policy) | Determines whether the user IAM role policy should be created | `bool` | `true` | no |
120120
| <a name="input_default_s3_location"></a> [default\_s3\_location](#input\_default\_s3\_location) | The Amazon S3 location to back up Amazon EMR Studio Workspaces and notebook files | `string` | `""` | no |
121121
| <a name="input_description"></a> [description](#input\_description) | A detailed description of the Amazon EMR Studio | `string` | `null` | no |
122+
| <a name="input_encryption_key_arn"></a> [encryption\_key\_arn](#input\_encryption\_key\_arn) | The AWS KMS key identifier (ARN) used to encrypt Amazon EMR Studio workspace and notebook files when backed up to Amazon S3 | `string` | `null` | no |
122123
| <a name="input_engine_security_group_description"></a> [engine\_security\_group\_description](#input\_engine\_security\_group\_description) | Description of the security group created | `string` | `"EMR Studio engine security group"` | no |
123124
| <a name="input_engine_security_group_id"></a> [engine\_security\_group\_id](#input\_engine\_security\_group\_id) | The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by `vpc_id` | `string` | `null` | no |
124125
| <a name="input_engine_security_group_rules"></a> [engine\_security\_group\_rules](#input\_engine\_security\_group\_rules) | Security group rules to add to the security group created | `any` | `{}` | no |

‎modules/studio/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ resource "aws_emr_studio" "this" {
2222
auth_mode = var.auth_mode
2323
default_s3_location = var.default_s3_location
2424
description = var.description
25+
encryption_key_arn = var.encryption_key_arn
2526
engine_security_group_id = local.create_security_groups ? aws_security_group.engine[0].id : var.engine_security_group_id
2627
idp_auth_url = var.idp_auth_url
2728
idp_relay_state_parameter_name = var.idp_relay_state_parameter_name

‎modules/studio/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ variable "description" {
3232
default = null
3333
}
3434

35+
variable "encryption_key_arn" {
36+
description = "The AWS KMS key identifier (ARN) used to encrypt Amazon EMR Studio workspace and notebook files when backed up to Amazon S3"
37+
type = string
38+
default = null
39+
}
40+
3541
variable "idp_auth_url" {
3642
description = "The authentication endpoint of your identity provider (IdP). Specify this value when you use IAM authentication and want to let federated users log in to a Studio with the Studio URL and credentials from your IdP"
3743
type = string

‎modules/studio/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

‎modules/virtual-cluster/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,14 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module
8282
| Name | Version |
8383
|------|---------|
8484
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
85-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
85+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.83 |
8686
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
8787

8888
## Providers
8989

9090
| Name | Version |
9191
|------|---------|
92-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
92+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.83 |
9393
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.10 |
9494

9595
## Modules

‎modules/virtual-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
kubernetes = {
1010
source = "hashicorp/kubernetes"

‎versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.65"
7+
version = ">= 5.83"
88
}
99
}
1010
}

0 commit comments

Comments
 (0)