chore: Create KMS keys for HV1 & HV2 branch keys (#1419)

Author: imabhichow

cfn/ESDK-Hierarchy-CI.yaml

@@ -162,6 +162,34 @@ Resources:
             Action: "kms:*"
             Resource: "*"
 
+  KmsKeyForHV1ReEncryptStrategy:
+    Type: "AWS::KMS::Key"
+    Properties:
+      Description: KMS Key for GitHub Action Workflow for HV1 Only Branch Keys
+      Enabled: true
+      KeyPolicy:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
+            Action: "kms:*"
+            Resource: "*"
+
+  KmsKeyForHV2Only:
+    Type: "AWS::KMS::Key"
+    Properties:
+      Description: KMS Key for GitHub Action Workflow for HV2 Only Branch Keys
+      Enabled: true
+      KeyPolicy:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
+            Action: "kms:*"
+            Resource: "*"
+
   KeyStoreAdminSystemKeyKmsSymEnc:
     Type: "AWS::KMS::Key"
     Properties:
@@ -242,14 +270,26 @@ Resources:
                 "arn:aws:kms:*:${AWS::AccountId}:key/${HierarchicalGitHubKMSKeyIDTwo}"
               ]
             },
+            {
+              "Effect": "Allow",
+              "Action": [
+                "kms:ReEncrypt*",
+                "kms:GenerateDataKeyWithoutPlaintext",
+                "kms:Decrypt"
+              ],
+              "Resource": [
+                "arn:aws:kms:*:${AWS::AccountId}:key/${KmsKeyForHV1ReEncryptStrategy}"
+              ]
+            }, 
             {
               "Effect": "Allow",
               "Action": [
                 "kms:Decrypt",
                 "kms:Encrypt"
               ],
               "Resource": [
-                "arn:aws:kms:*:${AWS::AccountId}:key/${KeyStoreAdminSystemKeyKmsSymEnc}"
+                "arn:aws:kms:*:${AWS::AccountId}:key/${KeyStoreAdminSystemKeyKmsSymEnc}",
+                "arn:aws:kms:*:${AWS::AccountId}:key/${KmsKeyForHV2Only}"
               ]
             },            
             {