stop prod key sharing (#1435)

LBHackney-IT · Sep 13, 2023 · 40680d1 · 40680d1
1 parent 58200b2
commit 40680d1
Showing 1 changed file with 0 additions and 36 deletions.
diff --git a/terraform/modules/qlik-sense-server/10-aws-ec2.tf b/terraform/modules/qlik-sense-server/10-aws-ec2.tf
@@ -112,16 +112,6 @@ data "aws_secretsmanager_secret_version" "central_backup_role_arn" {
   secret_id = data.aws_secretsmanager_secret.central_backup_role_arn[0].id
 }
 
-data "aws_secretsmanager_secret" "pre_prod_deployment_role_arn" {
-  count = var.is_production_environment ? 1 : 0
-  name  = "${var.identifier_prefix}-manually-managed-value-pre-prod-deployment-role-arn"
-}
-
-data "aws_secretsmanager_secret_version" "pre_prod_deployment_role_arn" {
-  count     = var.is_production_environment ? 1 : 0
-  secret_id = data.aws_secretsmanager_secret.pre_prod_deployment_role_arn[0].id
-}
-
 data "aws_iam_policy_document" "key_policy" {
   statement {
     effect = "Allow"
@@ -164,32 +154,6 @@ data "aws_iam_policy_document" "key_policy" {
       ]
     }
   }
-
-  dynamic "statement" {
-    for_each = var.is_production_environment ? [1] : []
-
-    content {
-      sid    = "AllowPreProdDeploymentRoleAccessToThisKey"
-      effect = "Allow"
-
-      principals {
-        type        = "AWS"
-        identifiers = [data.aws_secretsmanager_secret_version.pre_prod_deployment_role_arn[0].secret_string]
-      }
-
-      actions = [
-        "kms:Encrypt",
-        "kms:Decrypt",
-        "kms:ReEncrypt*",
-        "kms:GenerateDataKey*",
-        "kms:DescribeKey"
-      ]
-
-      resources = [
-        "*"
-      ]
-    }
-  }
 }
 
 resource "aws_kms_key" "key" {