Merge pull request #1015 from ministryofjustice/s3/replication-kms-key

Fix S3 Replication by Switching from KMS Key Alias to ARN

management-account/terraform/s3.tf

@@ -195,19 +195,23 @@ module "cur_reports_s3_bucket" {
   replication_bucket_arn = "arn:aws:s3:::moj-cur-reports-modplatform-20240930164810837800000001"
   replication_role_arn   = module.cur_reports_s3_bucket.replication_role_arn
   source_kms_arn         = "arn:aws:kms:*:${data.aws_caller_identity.current.account_id}:alias/aws/s3"
-  destination_kms_arn    = "arn:aws:kms:eu-west-2:${coalesce(local.modernisation_platform_accounts.core_logging_id...)}:alias/moj-cur-reports-key"
+  destination_kms_arn    = data.aws_ssm_parameter.core_logging_kms_key_arn.value
   replication_rules = [
     {
       id                 = "replicate-cur-athena"
       prefix             = "CUR-ATHENA/"
       status             = "Enabled"
       deletemarker       = "Enabled"
-      replica_kms_key_id = "arn:aws:kms:eu-west-2:${coalesce(local.modernisation_platform_accounts.core_logging_id...)}:alias/moj-cur-reports-key"
+      replica_kms_key_id = data.aws_ssm_parameter.core_logging_kms_key_arn.value
       metrics            = "Enabled"
     }
   ]
 }
 
+data "aws_ssm_parameter" "core_logging_kms_key_arn" {
+  name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/core-logging-kms-key"
+}
+
 data "aws_iam_policy_document" "cur_reports_s3_bucket" {
   version = "2008-10-17"