Fix: SUP-330: Make SSE adjustable

group.tf

@@ -64,6 +64,7 @@ resource "errorcheck_is_valid" "provider_project_constraint" {
 }
 
 resource "opentelekomcloud_identity_role_v3" "kms_access" {
+  count         = var.enable_sse ? 1 : 0
   display_name  = "${var.bucket_name}-kms-role"
   description   = "KMS encryption access role for ${var.bucket_name}."
   display_layer = "project"
@@ -77,7 +78,7 @@ resource "opentelekomcloud_identity_role_v3" "kms_access" {
   statement {
     effect = "Allow"
     resource = [
-      "KMS:*:*:KeyId:${opentelekomcloud_kms_key_v1.bucket_kms_key.id}"
+      "KMS:*:*:KeyId:${opentelekomcloud_kms_key_v1.bucket_kms_key[0].id}"
     ]
     action = [
       "kms:cmk:generate",
@@ -89,9 +90,10 @@ resource "opentelekomcloud_identity_role_v3" "kms_access" {
 }
 
 resource "opentelekomcloud_identity_role_assignment_v3" "kms_adm_to_obs_group" {
+  count      = var.enable_sse ? 1 : 0
   group_id   = opentelekomcloud_identity_group_v3.obs_group.id
   project_id = data.opentelekomcloud_identity_project_v3.current.id
-  role_id    = opentelekomcloud_identity_role_v3.kms_access.id
+  role_id    = opentelekomcloud_identity_role_v3.kms_access[0].id
   lifecycle {
     ignore_changes = [project_id]
   }

main.tf

@@ -5,7 +5,7 @@ resource "random_id" "bucket_kms_key_id" {
 
 resource "opentelekomcloud_kms_key_v1" "bucket_kms_key" {
   count           = var.enable_sse ? 1 : 0
-  key_alias       = "${var.bucket_name}-key-${random_id.bucket_kms_key_id.hex}"
+  key_alias       = "${var.bucket_name}-key-${random_id.bucket_kms_key_id[0].hex}"
   key_description = "${var.bucket_name} encryption key"
   pending_days    = 7
   is_enabled      = "true"
@@ -22,7 +22,7 @@ resource "opentelekomcloud_obs_bucket" "bucket" {
     for_each = var.enable_sse ? [1] : []
     content {
       algorithm  = "kms"
-      kms_key_id = opentelekomcloud_kms_key_v1.bucket_kms_key.id
+      kms_key_id = opentelekomcloud_kms_key_v1.bucket_kms_key[0].id
     }
   }
   tags = var.tags

moved.tf

@@ -0,0 +1,16 @@
+moved {
+  from = random_id.bucket_kms_key_id
+  to   = random_id.bucket_kms_key_id[0]
+}
+moved {
+  from = opentelekomcloud_kms_key_v1.bucket_kms_key
+  to   = opentelekomcloud_kms_key_v1.bucket_kms_key[0]
+}
+moved {
+  from = opentelekomcloud_identity_role_v3.kms_access
+  to   = opentelekomcloud_identity_role_v3.kms_access[0]
+}
+moved {
+  from = opentelekomcloud_identity_role_assignment_v3.kms_adm_to_obs_group
+  to   = opentelekomcloud_identity_role_assignment_v3.kms_adm_to_obs_group[0]
+}