chore: add secrets manager policy to cms role (#149)

Rebecca Dong · web-flow · commit 4ddd7935a0b2 · 2020-07-30T11:38:16.000-07:00
diff --git a/src/main/resources/cloudformation/iam-roles.yaml b/src/main/resources/cloudformation/iam-roles.yaml
@@ -33,6 +33,17 @@ Resources:
                   - cloudformation:SignalResource
                 Effect: Allow
                 Resource: '*'
+        - PolicyName: "cms-allow-sm-read"
+          PolicyDocument:
+            Statement:
+              - Action:
+                  - secretsmanager:GetResourcePolicy
+                  - secretsmanager:GetSecretValue
+                  - secretsmanager:DescribeSecret
+                  - secretsmanager:ListSecretVersionIds
+                Effect: Allow
+                Resource:
+                  - '*'
         - PolicyName: "cms-kms-policy"
           PolicyDocument:
             Statement:
