PLT-1482: Add Necessary KMS Keys to WAF Sync Lambda Permissions

[gfreeman-navapbc]

🎫 Ticket

https://jira.cms.gov/browse/PLT-1482

🛠 Changes

Adds environment and app config keys to lambda permissions passed through to function module.

ℹ️ Context

The DPC WAF sync lambdas have been very error heavy and the source is invalid key configuration in the terraform service. This change aims to add the necessary permissions to stop the lambdas from erroring out.

🧪 Validation

Tofu Plan Output (DPC/DEV)

OpenTofu will perform the following actions:

  # module.api_waf_sync_function.aws_iam_role_policy.default_function will be updated in-place
  ~ resource "aws_iam_role_policy" "default_function" {
        id     = "dpc-dev-api-waf-sync-function:default-function"
        name   = "default-function"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "ssm:GetParameters",
                            "ssm:GetParameter",
                            "sqs:ReceiveMessage",
                            "sqs:GetQueueAttributes",
                            "sqs:DeleteMessage",
                            "logs:PutLogEvents",
                            "logs:CreateLogStream",
                            "logs:CreateLogGroup",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeAccountAttributes",
                            "ec2:DeleteNetworkInterface",
                            "ec2:CreateNetworkInterface",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                  ~ {
                      ~ Resource = [
                          + "arn:aws:kms:us-east-1::key/69fc1eca-71e6-43e6-acd1-53f0b80a7ef6",
                            "arn:aws:kms:us-east-1::key/601028a8-2ef7-4bec-9e39-af26d91e07b9",
                            # (1 unchanged element hidden)
                        ]
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[jdettmannnava]

LGTM

[lukey-luke]

Resource matches error from cloudwatch HERE. Thanks for updating!