hub_ado_join_pak.tf

resource "aws_secretsmanager_secret_policy" "hub_ado_join_pak" {
  secret_arn = aws_secretsmanager_secret.hub_ado_join_pak.arn
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [{
        "Sid" : "AzureDevOpsBuildersSecretsAccess",
        "Effect" : "Allow",
        "Action" : "secretsmanager:GetSecretValue",
        "Resource" : "*",
        "Principal" : {
          "AWS" : [
            "arn:aws:iam::bbbbbbbbbb:role/SpokeABuilderExecutionRole"
          ]
        }
      }]
  })
}