Cloud extension + some extra things (see list)

platform-controller/AWS/swarm-mode/kms.yaml

@@ -0,0 +1,77 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: 'Docker Swarm - KMS'
+
+# https://github.com/pgarbe/containers_on_aws
+
+Resources:
+
+  SwarmTokenKey: 
+    Type: "AWS::KMS::Key"
+    Properties: 
+      Description: "KMS key to encrypt swarm join tokens"
+      KeyPolicy:
+        Id: key-docker-swarm
+        Version: '2012-10-17'
+        Statement:
+        - Sid: Enable IAM User Permissions
+          Effect: Allow
+          Principal:
+            AWS:
+            - !Sub arn:aws:iam::${AWS::AccountId}:root
+          Action: kms:*
+          Resource: "*"
+        # - Sid: Allow access for Key Administrators
+        #   Effect: Allow
+        #   Principal:
+        #     AWS:
+        #     - !Sub arn:aws:iam::${AWS::AccountId}:root
+        #   Action:
+        #   - kms:Create*
+        #   - kms:Describe*
+        #   - kms:Enable*
+        #   - kms:List*
+        #   - kms:Put*
+        #   - kms:Update*
+        #   - kms:Revoke*
+        #   - kms:Disable*
+        #   - kms:Get*
+        #   - kms:Delete*
+        #   - kms:TagResource
+        #   - kms:UntagResource
+        #   - kms:ScheduleKeyDeletion
+        #   - kms:CancelKeyDeletion
+        #   Resource: "*"
+        # - Sid: Allow use of the key
+        #   Effect: Allow
+        #   Principal:
+        #     AWS:
+        #     - !Sub arn:aws:iam::${AWS::AccountId}:root
+        #   Action:
+        #   - kms:Encrypt
+        #   - kms:Decrypt
+        #   - kms:ReEncrypt*
+        #   - kms:GenerateDataKey*
+        #   - kms:DescribeKey
+        #   Resource: "*"
+        # - Sid: Allow attachment of persistent resources
+        #   Effect: Allow
+        #   Principal:
+        #     AWS:
+        #     - !Sub arn:aws:iam::${AWS::AccountId}:root
+        #   Action:
+        #   - kms:CreateGrant
+        #   - kms:ListGrants
+        #   - kms:RevokeGrant
+        #   Resource: "*"
+        #   Condition:
+        #     Bool:
+        #       kms:GrantIsForAWSResource: true
+Outputs:
+
+  SwarmTokenKey:
+    Value: !Ref SwarmTokenKey
+
+  SwarmTokenKeyArn:
+    Value: !GetAtt SwarmTokenKey.Arn
+    Export:
+          Name: !Sub '${AWS::StackName}-SwarmTokenKeyArn'