Allow reading from parameter store in any region

eresearchqut · Oct 4, 2023 · 2ce4fa8 · 2ce4fa8
1 parent 8a03346
commit 2ce4fa8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/deployment/lib/github-stack.ts b/deployment/lib/github-stack.ts
@@ -104,7 +104,7 @@ export class GitHubStack extends cdk.Stack {
  const ssmPolicy = new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ["ssm:GetParameter"],
- resources: [`arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/app/${props.envName}/${props.repo}/env`]
+ resources: [`arn:aws:ssm:*:${cdk.Aws.ACCOUNT_ID}:parameter/app/${props.envName}/${props.repo}/env`]
  });
 
  const deployRole = new iam.Role(this, "deploy-role", {