Repository navigation
fix(terraform): accept every KMS key form the collector accepts - #82
Closed
tim-thacker-nullify wants to merge 1 commit into
Closed
tim-thacker-nullify wants to merge 1 commit into
tim-thacker-nullify wants to merge 1 commit into
Conversation
#78 added an ARN-only validation to k8s-resources.kms_key_arn, but that module writes no IAM policy: it forwards the value to the collector as NULLIFY_KMS_KEY_ARN, which S3 takes as SSEKMSKeyId. A caller who passed a bare key ID or alias/<name> before now fails at plan on upgrade. - accept key ARN, alias ARN, bare key ID and alias/<name>, in any partition - nullify-aws-integration keeps the strict ARN form: it builds IAM resources Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 15, 2026
Closed
fix(terraform): drop the unencrypted-upload opt-out and reject collector + managed scan together
#91
Closed
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round-1 review finding F10 on #78. Stacked on
fix/terraform-kms-image-region.#78 added an ARN-only validation to
k8s-resources.kms_key_arn, a variable that previously had none. That module writes no IAM policy: it forwards the value to the collector asNULLIFY_KMS_KEY_ARN, which the collector passes to S3 asSSEKMSKeyId. S3 accepts a bare key ID andalias/<name>there, so a caller already passing either now fails at plan on upgrade.k8s-resources.kms_key_arnaccepts key ARN, alias ARN, bare key ID andalias/<name>, in any partition (arn:aws[a-z-]*:), in bothterraform/andterraform-v6/nullify-aws-integration.kms_key_arnis unchanged and still ARN-only: it builds IAM policy resources from the parsed ARN#81'sk8s-resourcestests stay green against the new pattern:arn:aws:kms:eu-central-1:111122223333:alias/nullify-customer-uploadsstill matches,arn:aws:s3:::not-a-keystill does not.No terraform run locally (no local tooling by request); CI validates.
🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.