source/repositories/compliant-framework-central-core/templates/logging/logging-assets.yml [18:167]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: String

Resources:
  rLoggingS3BucketCmk:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F76
    Type: AWS::KMS::Key
    Properties:
      Description: Logging - S3 CMK
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:CancelKeyDeletion
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:CreateKey
              - kms:DeleteAlias
              - kms:DeleteImportedKeyMaterial
              - kms:DescribeKey
              - kms:DisableKey
              - kms:DisableKeyRotation
              - kms:EnableKey
              - kms:EnableKeyRotation
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:GetParametersForImport
              - kms:ImportKeyMaterial
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:RetireGrant
              - kms:RevokeGrant
              - kms:ScheduleKeyDeletion
              - kms:TagResource
              - kms:UntagResource
              - kms:UpdateAlias
              - kms:UpdateKeyDescription
            Resource: "*"
          - Sid: Allow Account root use of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow S3 service use of the key
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow VPC Flow Logs use of the key
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow CloudTrail use of the key
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow Organization use of the key
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref pPrincipalOrgId

  rSsmParameterLoggingS3BucketCmk:
    Type: AWS::SSM::Parameter
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/repositories/compliant-framework-management-services-core/templates/management-services-logging-assets.yml [24:173]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: String

Resources:
  rLoggingS3BucketCmk:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F76
    Type: AWS::KMS::Key
    Properties:
      Description: Logging - S3 CMK
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:CancelKeyDeletion
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:CreateKey
              - kms:DeleteAlias
              - kms:DeleteImportedKeyMaterial
              - kms:DescribeKey
              - kms:DisableKey
              - kms:DisableKeyRotation
              - kms:EnableKey
              - kms:EnableKeyRotation
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:GetParametersForImport
              - kms:ImportKeyMaterial
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:RetireGrant
              - kms:RevokeGrant
              - kms:ScheduleKeyDeletion
              - kms:TagResource
              - kms:UntagResource
              - kms:UpdateAlias
              - kms:UpdateKeyDescription
            Resource: "*"
          - Sid: Allow Account root use of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow S3 service use of the key
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:GenerateRandom
              - kms:GetKeyPolicy
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListGrants
              - kms:ListKeyPolicies
              - kms:ListKeys
              - kms:ListResourceTags
              - kms:ListRetirableGrants
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow VPC Flow Logs use of the key
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow CloudTrail use of the key
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
          - Sid: Allow Organization use of the key
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref pPrincipalOrgId

  rSsmParameterLoggingS3BucketCmk:
    Type: AWS::SSM::Parameter
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



