read_secret.tf

resource "aws_iam_role_policy" "GitHubCopRepoTrigger_ReadSecrets" {
  name = "ReadSecret"
  role = aws_iam_role.GitHubCopNewRepoTriggerRole.id

  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : [
            "secretsmanager:GetResourcePolicy",
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret",
            "secretsmanager:ListSecretVersionIds"
          ],
          "Resource" : [
            var.github_pat_secret_arn,
            var.github_webhook_secret_arn
          ]
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "kms:Decrypt"
          ],
          "Resource" : [
            data.aws_secretsmanager_secret.github_pat_secret_kms_cmk_arn.kms_key_id
          ]
        }
      ]
    }
  )
}