encryption-patterns

Files (1)

• SKILL.md

SKILL.md (first lines)

<!-- Vendored from: platform-catalyst/skills/encryption-patterns/SKILL.md (BittahCriminal/platform-catalyst, BSD-3-Clause). Adapted for Catalyst: PLAN.md/CLAUDE.md/DECISIONS.md scrubbed; ADR-008->ADR-001, ADR-009->ADR-002. -->

# Encryption patterns

## Role

You guide encryption-at-rest configuration for all Catalyst resources using the three-CMK strategy from `AGENTS.md` §5.5. You enforce that every encryption-capable resource uses customer-managed KMS keys with scoped key policies.

## Instructions

### 1. Three-CMK strategy (from AGENTS.md §5.5)

| Key alias | Purpose | Encrypts |
|-----------|---------|----------|
| `alias/catalyst-data` | Application data | Aurora, DynamoDB, app S3 buckets |
| `alias/catalyst-logs` | Logging data | CloudWatch Logs, access-log S3 |
| `alias/catalyst-secrets` | Secrets and config | Secrets Manager, SSM SecureString |

**Why three, not per-resource?** Cost (CMKs are $1/month each) + key-policy management fatigue. Three keys provide sufficient blast-radius isolation while keeping policies reviewable.

### 2. KMS key module

```hcl
# infrastructure/modules/leaf/kms-key/main.tf

resource "aws_kms_key" "this" {
  description             = var.description
  enable_key_rotation     = true  # Annual rotation — mandatory
  deletion_window_in_days = 30
  tags                    = local.common_tags

  policy = data.aws_iam_policy_document.key_policy.json
}

resource "aws_kms_alias" "this" {
  name          = "alias/${var.alias_name}"
  target_key_id = aws_kms_key.this.key_id
}
```

### 3. Key policy pattern

Per *CSPM* (Nomani, Ch 1 pp 26-27: cryptography and encryption):

```hcl
data "aws_iam_policy_document" "key_policy" {
  # Key administrators (Terraform role)
  statement {
    sid    = "KeyAdministration"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [var.admin_role_arn]
    }
    actions = [
      "kms:Create*",
      "kms:Describe*",
      "kms:Enable*",
      "kms:List*",
      "kms:Put*",
      "kms:Update*",
      "kms:Revoke*",
      "kms:Disable*",
      "kms:Get*",
      "kms:Delete*",
      "kms:ScheduleKeyDeletion",
      "kms:CancelKeyDeletion",
      "kms:TagResource",
      "kms:UntagResource",
    ]
    resources = ["*"]  # Key policy "Resource" always refers to the key itself
  }

  # Key usage (service roles)
  dynamic "statement" {
    for_each = var.usage_role_arns
    content {
      sid    = "KeyUsage-${statement.key}"
      effect = "Allow"
      principals {
        type        = "AWS"
        identifiers = [statement.value]
      }
      actions = [
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:DescribeKey",
      ]
      resources = ["*"]  # Within key policy, refers to this key
      condition {
        test     = "StringEquals"
        variable = "kms:ViaService"
        values   = var.via_services  # e.g., ["s3.us-east-1.amazonaws.com"]
      }
    }
  }

  # Deny all other principals — no Principal: "*" grants
}
```

**Key rule**: No `Principal: "*"` in key policies. Every grant is scoped to a specific role ARN with a `kms:ViaService` condition.

### 4. Service-specific encryption

**Aurora Serverless v2:**
```hcl
resource "aws_rds_cluster" "this" {
  storage_encrypted = true
  kms_key_id        = var.kms_key_arn  # alias/catalyst-data
  # ...
}
```

**S3:**
```hcl
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id

From Cloud-Byte-Consulting/Catalyst, BSD-3-Clause.

More from Cloud-Byte-Consulting/Catalyst