Commit d610954

authored

fix: Remove any secretsmanager:* permissions if no secret ARNs are provided to IRSA external-secrets permissions (#599)

1 parent 538a948 commit d610954Copy full SHA for d610954

File tree

+13

-8

lines changed

+13

-8

lines changed

Lines changed: 13 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -483,14 +483,19 @@ data "aws_iam_policy_document" "external_secrets" {`
`483`	`483`	`resources = ["*"]`
`484`	`484`	`}`
`485`	`485`
`486`		`- statement {`
`487`		`- actions = [`
`488`		`- "secretsmanager:GetResourcePolicy",`
`489`		`- "secretsmanager:GetSecretValue",`
`490`		`- "secretsmanager:DescribeSecret",`
`491`		`- "secretsmanager:ListSecretVersionIds"`
`492`		`- ]`
`493`		`- resources = var.external_secrets_secrets_manager_arns`
	`486`	`+ dynamic "statement" {`
	`487`	`+ for_each = length(var.external_secrets_secrets_manager_arns) > 0 ? [1] : []`
	`488`	`+`
	`489`	`+ content {`
	`490`	`+ actions = [`
	`491`	`+ "secretsmanager:GetResourcePolicy",`
	`492`	`+ "secretsmanager:GetSecretValue",`
	`493`	`+ "secretsmanager:DescribeSecret",`
	`494`	`+ "secretsmanager:ListSecretVersionIds"`
	`495`	`+ ]`
	`496`	`+`
	`497`	`+ resources = var.external_secrets_secrets_manager_arns`
	`498`	`+ }`
`494`	`499`	`}`
`495`	`500`
`496`	`501`	`dynamic "statement" {`

Comments

(0)