eli-540 attach roles to lambda and external role

Author: Karthikeyannhs

infrastructure/modules/secrets_manager/outputs.tf

@@ -0,0 +1,3 @@
+output "aws_hashing_secret_arn" {
+  value = aws_secretsmanager_secret.hashing_secret.arn
+}

infrastructure/modules/secrets_manager/variables.tf

@@ -1,6 +1,6 @@
 variable "external_write_access_role_arn" {
-  description = "Arn of the external write access role to provide secret manager access"
-  type        = string
+  description = "List of ARNs for external write access roles"
+  type = list(string)
 }
 
 variable "eligibility_lambda_role_arn" {

infrastructure/stacks/api-layer/iam_policies.tf

@@ -530,3 +530,34 @@ resource "aws_iam_role_policy" "external_audit_kms_access_policy" {
   role   = aws_iam_role.write_access_role[count.index].id
   policy = data.aws_iam_policy_document.external_role_s3_audit_kms_access_policy.json
 }
+
+# IAM policy document for Lambda secret access
+data "aws_iam_policy_document" "secrets_access_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "secretsmanager:GetSecretValue",
+      "secretsmanager:DescribeSecret",
+    ]
+
+    resources = [
+      module.secrets_manager.aws_hashing_secret_arn
+    ]
+  }
+}
+
+# Attach secret read policy to Lambda role
+resource "aws_iam_role_policy" "lambda_secret_read_policy_attachment" {
+  name   = "LambdaSecretReadAccess"
+  role   = aws_iam_role.eligibility_lambda_role.id
+  policy = data.aws_iam_policy_document.secrets_access_policy.json
+}
+
+# Attach secret read policy to external write role
+resource "aws_iam_role_policy" "external_secret_read_policy_attachment" {
+  count = length(aws_iam_role.write_access_role)
+  name   = "ExternalSecretReadAccess"
+  role   = aws_iam_role.write_access_role[count.index].id
+  policy = data.aws_iam_policy_document.secrets_access_policy.json
+}

infrastructure/stacks/api-layer/secrets_manager.tf

@@ -1,9 +1,8 @@
 module "secrets_manager" {
   source = "../../modules/secrets_manager"
-  count = length(aws_iam_role.write_access_role)
-  external_write_access_role_arn = aws_iam_role.write_access_role[count.index].arn
-  environment  = var.environment
-  stack_name   = local.stack_name
-  workspace    = terraform.workspace
-  eligibility_lambda_role_arn = aws_iam_role.eligibility_lambda_role.arn
+  external_write_access_role_arn = aws_iam_role.write_access_role[*].arn
+  environment                    = var.environment
+  stack_name                     = local.stack_name
+  workspace                      = terraform.workspace
+  eligibility_lambda_role_arn    = aws_iam_role.eligibility_lambda_role.arn
 }