[bugfix] fix permissions on aws-ecs-service secrets (#143)

Author: mbarrien

aws-ecs-service-fargate/iam.tf

@@ -26,26 +26,11 @@ resource "aws_iam_role_policy_attachment" "task_execution_role" {
 data "aws_iam_policy_document" "registry_secretsmanager" {
   count = var.registry_secretsmanager_arn != null ? 1 : 0
 
-  statement {
-    actions = [
-      "kms:Decrypt",
-    ]
-
-    resources = [var.registry_secretsmanager_arn]
-  }
-
   statement {
     actions = [
       "secretsmanager:GetSecretValue",
     ]
 
-    # Limit to only current version of the secret
-    condition {
-      test     = "ForAnyValue:StringEquals"
-      variable = "secretsmanager:VersionStage"
-      values   = ["AWSCURRENT"]
-    }
-
     resources = [var.registry_secretsmanager_arn]
   }
 }

aws-ecs-service/iam.tf

@@ -27,26 +27,11 @@ resource "aws_iam_role_policy_attachment" "task_execution_role" {
 data "aws_iam_policy_document" "registry_secretsmanager" {
   count = var.registry_secretsmanager_arn != null ? 1 : 0
 
-  statement {
-    actions = [
-      "kms:Decrypt",
-    ]
-
-    resources = [var.registry_secretsmanager_arn]
-  }
-
   statement {
     actions = [
       "secretsmanager:GetSecretValue",
     ]
 
-    # Limit to only current version of the secret
-    condition {
-      test     = "ForAnyValue:StringEquals"
-      variable = "secretsmanager:VersionStage"
-      values   = ["AWSCURRENT"]
-    }
-
     resources = [var.registry_secretsmanager_arn]
   }
 }