chore: add secrets manager policy to cms role (#149)

Nike-Inc · Jul 30, 2020 · 4ddd793 · 4ddd793
1 parent ca24bec
commit 4ddd793
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/src/main/resources/cloudformation/iam-roles.yaml b/src/main/resources/cloudformation/iam-roles.yaml
@@ -33,6 +33,17 @@ Resources:
                   - cloudformation:SignalResource
                 Effect: Allow
                 Resource: '*'
+        - PolicyName: "cms-allow-sm-read"
+          PolicyDocument:
+            Statement:
+              - Action:
+                  - secretsmanager:GetResourcePolicy
+                  - secretsmanager:GetSecretValue
+                  - secretsmanager:DescribeSecret
+                  - secretsmanager:ListSecretVersionIds
+                Effect: Allow
+                Resource:
+                  - '*'
         - PolicyName: "cms-kms-policy"
           PolicyDocument:
             Statement: