allow access to airflow env stg or prod in all containers (#1997)

* allow access to airflow env stg or prod in all containers

* add the arn in prod

Author: Tian-2017

terraform/modules/department/50-aws-iam-policies.tf

@@ -433,7 +433,9 @@ data "aws_iam_policy_document" "secrets_manager_read_only" {
       aws_secretsmanager_secret.redshift_cluster_credentials.arn,
       module.google_service_account.credentials_secret.arn,
       "arn:aws:secretsmanager:eu-west-2:${data.aws_caller_identity.current.account_id}:secret:${var.identifier_prefix}/${local.department_identifier}/*",
-      "arn:aws:secretsmanager:eu-west-2:${data.aws_caller_identity.current.account_id}:secret:${var.short_identifier_prefix}/${local.department_identifier}*"
+      "arn:aws:secretsmanager:eu-west-2:${data.aws_caller_identity.current.account_id}:secret:${var.short_identifier_prefix}/${local.department_identifier}*",
+      "arn:aws:secretsmanager:eu-west-2:${data.aws_caller_identity.current.account_id}:secret:airflow/variables/env-fxe5CD",
+      "arn:aws:secretsmanager:eu-west-2:${data.aws_caller_identity.current.account_id}:secret:airflow/variables/env-jeCYYl",
     ]
   }