Repository navigation
docs(helm): state the collector's KMS alias requirement and keep ci/ out of the package - #77
Closed
tim-thacker-nullify wants to merge 2 commits into
Closed
tim-thacker-nullify wants to merge 2 commits into
tim-thacker-nullify wants to merge 2 commits into
Conversation
- .helmignore excludes ci/ from 0.4.0, so a later edit to a CI values file does not change a published version's contents and force a version bump. - Added with the 0.4.0 bump because 0.2.0 is already published; the file changes the package contents. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…e current template - NOTES, README and values.yaml say what an alias in collector.kms.keyArn needs: the IAM role's KMS statement must cover the resolved key, for example arn:aws:kms:<region>:<account-id>:key/*. - CloudFormation: connector releases that include PR #64 grant key/* in the account and region of NullifyKMSKeyArn; the template on main grants only the ARN given. Terraform: the module accepts an alias; check the module version's KMS statement covers key/*. A key ARN works with every version. - New README section "KMS alias ARNs" holds the detail; the table, 0.4.0 upgrade notes and troubleshooting link to it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 14, 2026
Closed
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #72 (round-3 review, R3-72-1 and the collector half of R3-71-1). NOTES and README told alias users that "the current connector CloudFormation template" grants
key/*, but only #64/#69 do. The template on main grants just the given ARN.values.yamlnow state the requirement directly: with an alias incollector.kms.keyArn, the IAM role's KMS statement must cover the resolved key, for examplearn:aws:kms:<region>:<account-id>:key/*.key/*in the account and region ofNullifyKMSKeyArn". This is true whichever of feat: grant wafv2:Get*, ec2:GetEbsEncryptionByDefault and the missing Kubernetes list kinds #58 and feat(aws): CloudFormation and setup script for managed EKS scan access #64 merges first.key/*. Main's module grants onlyvar.kms_key_arn, and no Terraform PR grantingkey/*is open yet, so the text makes no claim that it does.helm-charts/nullify-k8s-collector/.helmignorewithci/. It lands with the 0.4.0 bump, because the file changes package contents and 0.2.0 is already published.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.