Merge pull request #10 from GSA/fix_iam

more iam fixes

Author: Brian Fitzwater - IDI-C

iam.tf

@@ -88,7 +88,9 @@ data "aws_iam_policy_document" "policy" {
     effect = "Allow"
     actions = [
       "secretsmanager:GetSecretValue",
-      "secretsmanager:UpdateSecret"
+      "secretsmanager:UpdateSecret",
+      "secretsmanager:PutSecretValue",
+      "secretsmanager:UpdateSecretVersionStage"
     ]
     resources = ["arn:aws:secretsmanager:${var.region}:${local.account_id}:secret:ansible-*"]
   }

lambda.tf

@@ -68,3 +68,10 @@ resource "aws_lambda_function" "rotate_keypair" {
 
   depends_on = [aws_iam_role_policy_attachment.attach]
 }
+
+# allow secretsmanager to trigger lambda
+resource "aws_lambda_permission" "secretsmanager_invoke" {
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.rotate_keypair.function_name
+  principal     = "secretsmanager.amazonaws.com"
+}