copilot addon for access to an aws secret

secrets.cfn.yaml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: "IAM policy allows access to an AWS secret"
Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.
Resources:
  IAMpolicyAllowSecrets:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - secretsmanager:GetResourcePolicy
              - secretsmanager:GetSecretValue
              - secretsmanager:DescribeSecret
              - secretsmanager:ListSecretVersionIds
            Resource:
              - "arn:aws:secretsmanager:<region>:<accountId>:secret:<secretName>"
Outputs:
  IAMpolicyAllowSecretsARN:
    Description: "The ARN of the ManagedPolicy to that allows secrets access."
    Value: !Ref IAMpolicyAllowSecrets
  NullResource:
    Description: "slurp default params to prevent linting warnings for unused vars"
    Value:
      Fn::Join:
        - ""
        - - "Ref": "App"
          - "Ref": "Env"
          - "Ref": "Name"