BFD-2884: Allow listing of SSM parameters (#1929)

CMSgov · Sep 11, 2023 · 6cc369a · 6cc369a
1 parent f8cb244
commit 6cc369a
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/ops/terraform/env/mgmt/iam.tf b/ops/terraform/env/mgmt/iam.tf
@@ -366,6 +366,17 @@ resource "aws_iam_policy" "bfd_ssm_ro" {
 {
   "Statement": [
     {
+      "Sid": "ListParameters",
+      "Action": [
+        "ssm:DescribeParameters"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:ssm:us-east-1:${local.account_id}:*"
+      ]
+    },
+    {
+      "Sid": "AllowReadBFDParams",
       "Action": [
         "ssm:GetParametersByPath",
         "ssm:GetParameters",
@@ -377,6 +388,7 @@ resource "aws_iam_policy" "bfd_ssm_ro" {
       ]
     },
     {
+      "Sid": "AllowKeyUsage",
       "Action": [
         "kms:Decrypt"
       ],