[PRMP-1318] replace aws_iam_policy references with local variables for SSM access policies

NogaNHS · NogaNHS · commit ca2a3cd521cc · 2026-01-21T15:31:51.000Z
Signed-off-by: NogaNHS &lt;127490765+NogaNHS@users.noreply.github.com&gt;
diff --git a/infrastructure/lambda-back-channel-logout.tf b/infrastructure/lambda-back-channel-logout.tf
@@ -14,7 +14,7 @@ module "back_channel_logout_lambda" {
   name    = "BackChannelLogoutHandler"
   handler = "handlers.back_channel_logout_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.auth_session_dynamodb_table.dynamodb_read_policy_document,
     module.auth_session_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-app-config.app_config_policy
diff --git a/infrastructure/lambda-bulk-upload-metadata-processor.tf b/infrastructure/lambda-bulk-upload-metadata-processor.tf
@@ -15,7 +15,7 @@ module "bulk-upload-metadata-processor-lambda" {
     module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,
     module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
   ]
 
diff --git a/infrastructure/lambda-bulk-upload.tf b/infrastructure/lambda-bulk-upload.tf
@@ -19,7 +19,7 @@ module "bulk-upload-lambda" {
     module.sqs-lg-bulk-upload-invalid-queue.sqs_write_policy_document,
     module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,
     module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-create-doc-ref.tf b/infrastructure/lambda-create-doc-ref.tf
@@ -56,7 +56,7 @@ module "create-doc-ref-lambda" {
     module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-document-status-check-result.tf b/infrastructure/lambda-document-status-check-result.tf
@@ -57,7 +57,7 @@ module "document-status-check-lambda" {
   handler = "handlers.document_status_check_handler.lambda_handler"
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.document_reference_dynamodb_table.dynamodb_read_policy_document,
     module.document_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/lambda-document-upload-check.tf b/infrastructure/lambda-document-upload-check.tf
@@ -7,7 +7,7 @@ module "document_upload_check_lambda" {
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.ndr-lloyd-george-store.s3_write_policy_document,
     module.pdm-document-store.s3_write_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
     data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
diff --git a/infrastructure/lambda-dynamodb-migration.tf b/infrastructure/lambda-dynamodb-migration.tf
@@ -9,7 +9,7 @@ module "migration-dynamodb-lambda" {
     module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,
     module.ndr-bulk-staging-store.s3_read_policy_document,
     module.ndr-lloyd-george-store.s3_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
     module.migration-failed-items-store.s3_write_policy_document
   ]
diff --git a/infrastructure/lambda-feature-flags.tf b/infrastructure/lambda-feature-flags.tf
@@ -57,7 +57,7 @@ module "feature-flags-lambda" {
   handler = "handlers.feature_flags_handler.lambda_handler"
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-get-doc-ref.tf b/infrastructure/lambda-get-doc-ref.tf
@@ -45,7 +45,7 @@ module "get-doc-ref-lambda" {
   iam_role_policy_documents = [
     module.ndr-lloyd-george-store.s3_read_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
     module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document
   ]
diff --git a/infrastructure/lambda-get-document-fhir.tf b/infrastructure/lambda-get-document-fhir.tf
@@ -40,8 +40,8 @@ module "get-doc-fhir-lambda" {
     module.ndr-app-config.app_config_policy,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
     module.core_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
-    aws_iam_policy.mtls_access_ssm_policy.policy,
+    local.ssm_access_policy_policy,
+    local.mtls_access_ssm_policy_policy,
     module.ndr-lloyd-george-store.s3_read_policy_document,
     module.pdm-document-store.s3_read_policy_document,
   ]
diff --git a/infrastructure/lambda-get-document-review.tf b/infrastructure/lambda-get-document-review.tf
@@ -7,7 +7,7 @@ module "get_document_review_lambda" {
     module.cloudfront_edge_dynamodb_table.dynamodb_read_policy_document,
     module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-document-pending-review-store.s3_read_policy_document
   ]
 
diff --git a/infrastructure/lambda-get-report-by-ods.tf b/infrastructure/lambda-get-report-by-ods.tf
@@ -54,7 +54,7 @@ module "get-report-by-ods-lambda" {
   name    = "GetReportByODS"
   handler = "handlers.get_report_by_ods_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
     module.statistical-reports-store.s3_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/lambda-im-alerting.tf b/infrastructure/lambda-im-alerting.tf
@@ -19,7 +19,7 @@ module "im-alerting-lambda" {
   name    = "IMAlertingLambda"
   handler = "handlers.im_alerting_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     aws_iam_policy.alerting_lambda_alarms.policy,
     aws_iam_policy.alerting_lambda_tags.policy,
     module.ndr-app-config.app_config_policy,
diff --git a/infrastructure/lambda-login-redirect.tf b/infrastructure/lambda-login-redirect.tf
@@ -20,7 +20,7 @@ module "login_redirect_lambda" {
   name    = "LoginRedirectHandler"
   handler = "handlers.login_redirect_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.auth_state_dynamodb_table.dynamodb_read_policy_document,
     module.auth_state_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-app-config.app_config_policy
diff --git a/infrastructure/lambda-logout.tf b/infrastructure/lambda-logout.tf
@@ -14,7 +14,7 @@ module "logout_lambda" {
   name    = "LogoutHandler"
   handler = "handlers.logout_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.auth_session_dynamodb_table.dynamodb_read_policy_document,
     module.auth_session_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-app-config.app_config_policy
diff --git a/infrastructure/lambda-manage-nrl-pointer.tf b/infrastructure/lambda-manage-nrl-pointer.tf
@@ -7,7 +7,7 @@ module "manage-nrl-pointer-lambda" {
     module.ndr-app-config.app_config_policy,
     module.sqs-nrl-queue.sqs_read_policy_document,
     module.sqs-nrl-queue.sqs_write_policy_document,
-    aws_iam_policy.ssm_access_policy.policy
+    local.ssm_access_policy_policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = null
diff --git a/infrastructure/lambda-mns-notification.tf b/infrastructure/lambda-mns-notification.tf
@@ -10,7 +10,7 @@ module "mns-notification-lambda" {
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
     aws_iam_policy.kms_mns_lambda_access[0].policy,
   ]
diff --git a/infrastructure/lambda-nhs-oauth-token-generator.tf b/infrastructure/lambda-nhs-oauth-token-generator.tf
@@ -4,7 +4,7 @@ module "nhs-oauth-token-generator-lambda" {
   handler        = "handlers.nhs_oauth_token_generator_handler.lambda_handler"
   lambda_timeout = 120
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy
   ]
 
diff --git a/infrastructure/lambda-patch-document-review.tf b/infrastructure/lambda-patch-document-review.tf
@@ -6,7 +6,7 @@ module "patch_document_review_lambda" {
     module.ndr-app-config.app_config_policy,
     module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-document-pending-review-store.s3_write_policy_document
   ]
 
diff --git a/infrastructure/lambda-post-document-fhir.tf b/infrastructure/lambda-post-document-fhir.tf
@@ -8,8 +8,8 @@ module "post-document-references-fhir-lambda" {
     module.core_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.mtls_access_ssm_policy.policy,
-    aws_iam_policy.ssm_access_policy.policy
+    local.mtls_access_ssm_policy_policy,
+    local.ssm_access_policy_policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-post-document-review.tf b/infrastructure/lambda-post-document-review.tf
@@ -6,7 +6,7 @@ module "post_document_review_lambda" {
     module.ndr-app-config.app_config_policy,
     module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document,
   ]
diff --git a/infrastructure/lambda-review-document-status.tf b/infrastructure/lambda-review-document-status.tf
@@ -4,7 +4,7 @@ module "review-document-status-check-lambda" {
   handler = "handlers.review_document_status_check_handler.lambda_handler"
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-search-doc-references.tf b/infrastructure/lambda-search-doc-references.tf
@@ -64,7 +64,7 @@ module "search-document-references-lambda" {
     module.ndr-lloyd-george-store.s3_read_policy_document,
     module.ndr-document-store.s3_read_policy_document,
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy
+    local.ssm_access_policy_policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-search-document-references-fhir.tf b/infrastructure/lambda-search-document-references-fhir.tf
@@ -12,8 +12,8 @@ module "search-document-references-fhir-lambda" {
     module.ndr-lloyd-george-store.s3_read_policy_document,
     module.ndr-document-store.s3_read_policy_document,
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.mtls_access_ssm_policy.policy,
-    aws_iam_policy.ssm_access_policy.policy
+    local.mtls_access_ssm_policy_policy,
+    local.ssm_access_policy_policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-search-document-review.tf b/infrastructure/lambda-search-document-review.tf
@@ -5,7 +5,7 @@ module "search_document_review_lambda" {
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy
+    local.ssm_access_policy_policy
   ]
 
   rest_api_id                   = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-search-patient.tf b/infrastructure/lambda-search-patient.tf
@@ -55,7 +55,7 @@ module "search-patient-details-lambda" {
   name    = "SearchPatientDetailsLambda"
   handler = "handlers.search_patient_details_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
     module.auth_session_dynamodb_table.dynamodb_write_policy_document,
     module.auth_session_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/lambda-send-feedback.tf b/infrastructure/lambda-send-feedback.tf
@@ -79,7 +79,7 @@ module "send-feedback-lambda" {
   name    = "SendFeedbackLambda"
   handler = "handlers.send_feedback_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     aws_iam_policy.ses_send_email_policy.policy,
     module.ndr-app-config.app_config_policy
   ]
diff --git a/infrastructure/lambda-token.tf b/infrastructure/lambda-token.tf
@@ -14,7 +14,7 @@ module "create-token-lambda" {
   name    = "TokenRequestHandler"
   handler = "handlers.token_handler.lambda_handler"
   iam_role_policy_documents = [
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.auth_session_dynamodb_table.dynamodb_read_policy_document,
     module.auth_session_dynamodb_table.dynamodb_write_policy_document,
     module.auth_state_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/lambda-update-doc-ref.tf b/infrastructure/lambda-update-doc-ref.tf
@@ -51,7 +51,7 @@ module "update-doc-ref-lambda" {
     module.ndr-document-store.s3_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.ndr-app-config.app_config_policy,
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-virus-scan-result.tf b/infrastructure/lambda-virus-scan-result.tf
@@ -59,7 +59,7 @@ module "virus_scan_result_lambda" {
     module.ndr-bulk-staging-store.s3_read_policy_document,
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.ndr-app-config.app_config_policy,
-    aws_iam_policy.ssm_access_policy.policy,
+    local.ssm_access_policy_policy,
     module.document_reference_dynamodb_table.dynamodb_read_policy_document,
     module.document_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/moved-resources-v1.6.11.tf b/infrastructure/moved-resources-v1.6.11.tf
@@ -12,3 +12,14 @@ moved {
   from = aws_cloudfront_cache_policy.nocache
   to   = aws_cloudfront_cache_policy.nocache[0]
 }
+
+moved {
+  from = aws_iam_policy.ssm_access_policy
+  to   = aws_iam_policy.ssm_access_policy[0]
+}
+
+moved {
+  from = aws_iam_policy.mtls_access_ssm_policy
+  to   = aws_iam_policy.mtls_access_ssm_policy[0]
+}
+
diff --git a/infrastructure/policies.tf b/infrastructure/policies.tf
@@ -1,5 +1,6 @@
 resource "aws_iam_policy" "ssm_access_policy" {
-  name = "${terraform.workspace}_ssm_parameters"
+  count = local.is_sandbox ? 0 : 1
+  name  = "${terraform.workspace}_ssm_parameters"
   policy = jsonencode({
     Version = "2012-10-17",
     Statement = [
@@ -111,7 +112,8 @@ resource "aws_iam_policy" "transfer_family_kill_switch" {
 }
 
 resource "aws_iam_policy" "mtls_access_ssm_policy" {
-  name = "${terraform.workspace}_mtls_ssm_parameters"
+  count = local.is_sandbox ? 0 : 1
+  name  = "${terraform.workspace}_mtls_ssm_parameters"
   policy = jsonencode({
     Version = "2012-10-17",
     Statement = [
@@ -127,3 +129,24 @@ resource "aws_iam_policy" "mtls_access_ssm_policy" {
     ]
   })
 }
+
+data "aws_iam_policy" "dev_environment_ssm_access" {
+  count = local.is_sandbox ? 1 : 0
+  name  = "${var.shared_infra_workspace}_ssm_parameters"
+}
+
+data "aws_iam_policy" "dev_environment_mtls_access" {
+  count = local.is_sandbox ? 1 : 0
+  name  = "${var.shared_infra_workspace}_mtls_ssm_parameters"
+}
+
+locals {
+  ssm_access_policy_policy = local.is_sandbox ? (
+    data.aws_iam_policy.dev_environment_ssm_access[0].policy
+  ) : aws_iam_policy.ssm_access_policy[0].policy
+
+  mtls_access_ssm_policy_policy = local.is_sandbox ? (
+    data.aws_iam_policy.dev_environment_mtls_access[0].policy
+  ) : aws_iam_policy.mtls_access_ssm_policy[0].policy
+}
+

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ module "bulk-upload-metadata-processor-lambda" {`
`15`	`15`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,`
`16`	`16`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,`
`17`	`17`	`module.ndr-app-config.app_config_policy,`
`18`		`- aws_iam_policy.ssm_access_policy.policy,`
	`18`	`+ local.ssm_access_policy_policy,`
`19`	`19`	`data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,`
`20`	`20`	`]`
`21`	`21`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ module "bulk-upload-lambda" {`
`19`	`19`	`module.sqs-lg-bulk-upload-invalid-queue.sqs_write_policy_document,`
`20`	`20`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,`
`21`	`21`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,`
`22`		`- aws_iam_policy.ssm_access_policy.policy,`
	`22`	`+ local.ssm_access_policy_policy,`
`23`	`23`	`module.ndr-app-config.app_config_policy`
`24`	`24`	`]`
`25`	`25`	`kms_deletion_window = var.kms_deletion_window`
Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,7 @@ module "create-doc-ref-lambda" {`
`56`	`56`	`module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,`
`57`	`57`	`module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,`
`58`	`58`	`module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,`
`59`		`- aws_iam_policy.ssm_access_policy.policy,`
	`59`	`+ local.ssm_access_policy_policy,`
`60`	`60`	`module.ndr-app-config.app_config_policy,`
`61`	`61`	`]`
`62`	`62`	`kms_deletion_window = var.kms_deletion_window`
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ module "migration-dynamodb-lambda" {`
`9`	`9`	`module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,`
`10`	`10`	`module.ndr-bulk-staging-store.s3_read_policy_document,`
`11`	`11`	`module.ndr-lloyd-george-store.s3_read_policy_document,`
`12`		`- aws_iam_policy.ssm_access_policy.policy,`
	`12`	`+ local.ssm_access_policy_policy,`
`13`	`13`	`module.ndr-app-config.app_config_policy,`
`14`	`14`	`module.migration-failed-items-store.s3_write_policy_document`
`15`	`15`	`]`
Original file line number	Diff line number	Diff line change
`@@ -57,7 +57,7 @@ module "feature-flags-lambda" {`
`57`	`57`	`handler = "handlers.feature_flags_handler.lambda_handler"`
`58`	`58`	`iam_role_policy_documents = [`
`59`	`59`	`module.ndr-app-config.app_config_policy,`
`60`		`- aws_iam_policy.ssm_access_policy.policy,`
	`60`	`+ local.ssm_access_policy_policy,`
`61`	`61`	`]`
`62`	`62`	`kms_deletion_window = var.kms_deletion_window`
`63`	`63`	`rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id`
Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ module "get-doc-ref-lambda" {`
`45`	`45`	`iam_role_policy_documents = [`
`46`	`46`	`module.ndr-lloyd-george-store.s3_read_policy_document,`
`47`	`47`	`module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,`
`48`		`- aws_iam_policy.ssm_access_policy.policy,`
	`48`	`+ local.ssm_access_policy_policy,`
`49`	`49`	`module.ndr-app-config.app_config_policy,`
`50`	`50`	`module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document`
`51`	`51`	`]`