fix: Add more permission for external-secret to write to AWS Secrets …

…Manager
terraform-aws-modules · Aug 24, 2023 · 298e301 · 298e301
1 parent 2ce2fd1
commit 298e301
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/modules/iam-role-for-service-accounts-eks/policies.tf b/modules/iam-role-for-service-accounts-eks/policies.tf
@@ -511,11 +511,26 @@ data "aws_iam_policy_document" "external_secrets" {
     for_each = var.external_secrets_secrets_manager_create_permission ? [1] : []
     content {
       actions = [
-        "secretsmanager:CreateSecret"
+        "secretsmanager:CreateSecret",
+        "secretsmanager:PutSecretValue",
+        "secretsmanager:TagResource",
       ]
       resources = var.external_secrets_secrets_manager_arns
     }
   }
+
+  dynamic "statement" {
+    for_each = var.external_secrets_secrets_manager_create_permission ? [1] : []
+    content {
+      actions   = ["secretsmanager:DeleteSecret"]
+      resources = var.external_secrets_secrets_manager_arns
+      condition {
+        test     = "StringEquals"
+        variable = "secretsmanager:ResourceTag/managed-by"
+        values   = ["external-secrets"]
+      }
+    }
+  }
 }
 
 resource "aws_iam_policy" "external_secrets" {