From dd1c7358d7fc788e09ef98a28dfcfb9c3af7942f Mon Sep 17 00:00:00 2001 From: Daniel Ciaglia Date: Wed, 22 Mar 2023 10:52:22 +0100 Subject: [PATCH] fix IAM permissions for external-secrets SA `ssm:DescribeParameters` seems to need a resource wildcard --- modules/external-secrets/data.tf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/external-secrets/data.tf b/modules/external-secrets/data.tf index 4b381acf..2d75e2ab 100644 --- a/modules/external-secrets/data.tf +++ b/modules/external-secrets/data.tf @@ -19,4 +19,10 @@ data "aws_iam_policy_document" "external_secrets" { ["arn:${var.addon_context.aws_partition_id}:secretsmanager:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:secret:*"] ) } + + statement { + # it seems `ssm:DescribeParameters` needs wildcard on resources. + actions = ["ssm:DescribeParameters"] + resources = ["arn:${var.addon_context.aws_partition_id}:ssm:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:*"] + } }