add iam role app_execution

ministryofjustice · Feb 2, 2024 · 15bf2ff · 15bf2ff
1 parent 2ebb6eb
commit 15bf2ff
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/terraform/environments/cdpt-ifs/ecs.tf b/terraform/environments/cdpt-ifs/ecs.tf
@@ -95,3 +95,27 @@ EOF
   )
 }
 
+resource "aws_iam_role_policy" "app_execution" {
+  name = "execution-${var.networking[0].application}"
+  role = aws_iam_role.app_execution.id
+
+  policy = <<-EOF
+  {
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+           "Action": [
+              "ecr:*",
+              "logs:CreateLogGroup",
+              "logs:CreateLogStream",
+              "logs:PutLogEvents",
+              "logs:DescribeLogStreams",
+              "secretsmanager:GetSecretValue"
+           ],
+           "Resource": "*",
+           "Effect": "Allow"
+      }
+    ]
+  }
+  EOF
+}