Skip to content

[PLT-1390] Removing DPC sns topic key references.#355

Merged
jscott-nava merged 1 commit into
mainfrom
jscott/PLT-1390
Dec 12, 2025
Merged

[PLT-1390] Removing DPC sns topic key references.#355
jscott-nava merged 1 commit into
mainfrom
jscott/PLT-1390

Conversation

@jscott-nava

@jscott-nava jscott-nava commented Dec 11, 2025

Copy link
Copy Markdown
Contributor

🎫 Ticket

https://jira.cms.gov/browse/PLT-1390

🛠 Changes

This PR removes TF data references to the now deleted DPC SNS topic key, which was removed from the dpc-ops repo in a related PR.

ℹ️ Context

As part of the alarm-to-slack service work the DPC CloudWatch alarm topic was updated to use the shared dpc-<env> KMS key instead of the custom DPC SNS topic key, and that custom key was destroyed. This PR cleans up references to that custom key that continued to exist in the github-actions-role service.

🧪 Validation

Tofu plan output (DPC-DEV)
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_role_policy will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_role_policy" {
        id          = "dpc-dev-github-actions:terraform-2025xxxxxxxxxxxxxxxxxxxxxx"
        name        = "terraform-2025xxxxxxxxxxxxxxxxxxxxxx"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                    # (12 unchanged elements hidden)
                    {
                        Action   = [
                            "kms:ListAliases",
                            "kms:GetKeyRotationStatus",
                            "kms:GetKeyPolicy",
                            "kms:EnableKeyRotation",
                            "kms:CreateKey",
                            "kms:CreateAlias",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "KmsUsage"
                    },
                  ~ {
                      ~ Resource = [
                            # (3 unchanged elements hidden)
                            "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-web-admin-cloudwatch-key",
                          - "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-sns-topic-key",
                            "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-master-key",
                            # (4 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "firehose:StartDeliveryStreamEncryption",
                            "firehose:DescribeDeliveryStream",
                            "firehose:CreateDeliveryStream",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                    # (12 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

@jscott-nava jscott-nava marked this pull request as ready for review December 12, 2025 00:00
@jscott-nava jscott-nava requested a review from a team as a code owner December 12, 2025 00:00
@jscott-nava jscott-nava merged commit 377c8bf into main Dec 12, 2025
15 checks passed
@jscott-nava jscott-nava deleted the jscott/PLT-1390 branch December 12, 2025 16:18
juliareynolds-nava pushed a commit that referenced this pull request Jan 6, 2026
## 🎫 Ticket

https://jira.cms.gov/browse/PLT-1390

## 🛠 Changes

This PR removes TF data references to the now deleted DPC SNS topic key,
which was removed from the dpc-ops repo in a related PR.

## ℹ️ Context

As part of the alarm-to-slack service work the DPC CloudWatch alarm
topic was updated to use the shared dpc-\<env\> KMS key instead of the
custom DPC SNS topic key, and that custom key was destroyed. This PR
cleans up references to that custom key that continued to exist in the
github-actions-role service.

## 🧪 Validation
<details>
<summary>Tofu plan output (DPC-DEV)</summary> 

```
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_role_policy will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_role_policy" {
        id          = "dpc-dev-github-actions:terraform-2025xxxxxxxxxxxxxxxxxxxxxx"
        name        = "terraform-2025xxxxxxxxxxxxxxxxxxxxxx"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                    # (12 unchanged elements hidden)
                    {
                        Action   = [
                            "kms:ListAliases",
                            "kms:GetKeyRotationStatus",
                            "kms:GetKeyPolicy",
                            "kms:EnableKeyRotation",
                            "kms:CreateKey",
                            "kms:CreateAlias",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "KmsUsage"
                    },
                  ~ {
                      ~ Resource = [
                            # (3 unchanged elements hidden)
                            "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-web-admin-cloudwatch-key",
                          - "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-sns-topic-key",
                            "arn:aws:kms:us-east-1:xxxxxxxxxxxx:alias/dpc-dev-master-key",
                            # (4 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "firehose:StartDeliveryStreamEncryption",
                            "firehose:DescribeDeliveryStream",
                            "firehose:CreateDeliveryStream",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                    # (12 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
```
</details>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants