SpokeABuilderExecutionRoleSsmRead.tf

resource "aws_iam_role_policy" "SpokeABuilderExecutionRoleSsmRead" {
  name   = "SpokeABuilderExecutionRoleSsmRead"
  role   = aws_iam_role.SpokeABuilderExecutionRole.id
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : [
            "secretsmanager:GetSecretValue"
          ],
          "Resource" : [
            "arn:aws:secretsmanager:us-east-1:aaaaaaaaaaa:secret:SecretName*" <-- Note the "*" at the end, this is required, the ARN in the Hub account
          ]
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "kms:Decrypt"
          ],
          "Resource" : [
            "arn:aws:kms:us-east-1:aaaaaaaa:key/1111111-22222-33333-444444444444" <-- The ARN of the key in the Hub account
          ]
        }
      ]
    }
  )
}