feat: Set kms_key_identifier for EventBridge archives

examples/with-archive/main.tf

@@ -7,6 +7,10 @@ provider "aws" {
   skip_credentials_validation = true
 }
 
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+
 module "eventbridge" {
   source = "../../"
 
@@ -48,8 +52,9 @@ module "eventbridge" {
 module "eventbridge_archive_only" {
   source = "../../"
 
-  create_bus      = false
-  create_archives = true
+  create_bus         = false
+  create_archives    = true
+  kms_key_identifier = module.kms.key_id
 
   archives = {
     "launch-archive-existing-bus" = {
@@ -79,3 +84,48 @@ resource "random_pet" "this" {
 resource "aws_cloudwatch_event_bus" "existing_bus" {
   name = "${random_pet.this.id}-existing-bus"
 }
+
+module "kms" {
+  source      = "terraform-aws-modules/kms/aws"
+  version     = "~> 2.0"
+  description = "KMS key for cross region automated backups replication"
+
+  # Aliases
+  aliases                 = ["test"]
+  aliases_use_name_prefix = true
+  key_statements = [
+    {
+      sid = "Allow eventbridge"
+      principals = [
+        {
+          type        = "Service"
+          identifiers = ["events.amazonaws.com"]
+        }
+      ]
+      actions = [
+        "kms:DescribeKey",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
+      resources = ["*"]
+      conditions = [
+        {
+          test     = "StringEquals"
+          variable = "kms:EncryptionContext:aws:events:event-bus:arn"
+          values = [
+            "arn:aws:events:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:event-bus/example",
+          ]
+        },
+        {
+          test     = "StringEquals"
+          variable = "aws:SourceArn"
+          values = [
+            "arn:aws:events:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:event-bus/example",
+          ]
+        }
+      ]
+    }
+  ]
+
+  key_owners = [data.aws_caller_identity.current.arn]
+}

main.tf

@@ -284,8 +284,9 @@ resource "aws_cloudwatch_event_archive" "this" {
 
   region = var.region
 
-  name             = lookup(each.value, "name", each.key)
-  event_source_arn = try(each.value["event_source_arn"], aws_cloudwatch_event_bus.this[0].arn)
+  name               = lookup(each.value, "name", each.key)
+  event_source_arn   = try(each.value["event_source_arn"], aws_cloudwatch_event_bus.this[0].arn)
+  kms_key_identifier = var.kms_key_identifier
 
   description    = lookup(each.value, "description", null)
   event_pattern  = lookup(each.value, "event_pattern", null)
@@ -667,8 +668,9 @@ resource "aws_pipes_pipe" "this" {
   source = each.value.source
   target = each.value.target
 
-  description   = lookup(each.value, "description", null)
-  desired_state = lookup(each.value, "desired_state", null)
+  kms_key_identifier = var.kms_key_identifier
+  description        = lookup(each.value, "description", null)
+  desired_state      = lookup(each.value, "desired_state", null)
 
   dynamic "source_parameters" {
     for_each = try([each.value.source_parameters], [])

versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 6.0"
+      version = ">= 6.2"
     }
   }
 }