KMS access denied when trying to save an app with the GitHub PAT option populated.

[kendavis2]

Explanation

When trying to integrate an application in udeploy with GitHub to display commit history, a GitHub Personal Access Token (PAT) is requited. However, when you enter the PAT on the app configuration portal screen and try to save, you receive an error stating KMS access is denied, and the save is aborted. If you clear the Personal Access Token field, you can then save successfully.

Solution

Give the udeploy role access to encrypt using the KMS key.

https://github.com/turnerlabs/udeploy/blob/master/infrastructure/modules/portal/kms.tf

list of saml users for policies
    configUserIds = flatten([
        data.aws_caller_identity.current.account_id,
        "${aws_iam_role.app_role.unique_id}:*",  <<<<-----------
        formatlist(
        "%s:%s",
        data.aws_iam_role.saml_role_config.unique_id,
        var.saml_users,
        )
   ])