Skip to content

Commit 3ac7dae

Browse files
update perms
1 parent f15335f commit 3ac7dae

File tree

1 file changed

+20
-0
lines changed

1 file changed

+20
-0
lines changed

cfn/ESDK-Python.yml

+20
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ Resources:
186186
- !Ref CryptoToolsKMS
187187
- !Ref CodeBuildCIBatchPolicy
188188
- !Ref CodeBuildBasePolicy
189+
- !Ref SecretsManagerCIPolicy
189190

190191
CodeBuildBatchPolicy:
191192
Type: "AWS::IAM::ManagedPolicy"
@@ -309,6 +310,25 @@ Resources:
309310
}
310311
]
311312
}
313+
314+
SecretsManagerCIPolicy:
315+
Type: "AWS::IAM::ManagedPolicy"
316+
Properties:
317+
ManagedPolicyName: !Sub "CryptoTools-SecretsManager-${ProjectName}-release"
318+
Path: "/service-role/"
319+
PolicyDocument: !Sub |
320+
{
321+
"Version": "2012-10-17",
322+
"Statement": [
323+
{
324+
"Effect": "Allow",
325+
"Resource": [
326+
"arn:aws:secretsmanager:us-west-2:587316601012:secret:Github/aws-crypto-tools-ci-bot-AGUB3U"
327+
],
328+
"Action": "secretsmanager:GetSecretValue"
329+
}
330+
]
331+
}
312332
313333
# There exist public AWS KMS CMKs that are used for testing
314334
# Take care with these CMKs they are **ONLY** for testing!!!

0 commit comments

Comments
 (0)