From cf88dea3e4218b5ee29b3a9b1d921d854a0e00b4 Mon Sep 17 00:00:00 2001
From: Luigi Di Fraia <93160889+luigidifraiawork@users.noreply.github.com>
Date: Tue, 15 Oct 2024 08:59:06 +0100
Subject: [PATCH] feat: add secret to hold Ingest server root CA certificate
 data

---
 .../environments/xhibit-portal/xp-secrets.tf  | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/terraform/environments/xhibit-portal/xp-secrets.tf b/terraform/environments/xhibit-portal/xp-secrets.tf
index e4192865191..4208a777503 100644
--- a/terraform/environments/xhibit-portal/xp-secrets.tf
+++ b/terraform/environments/xhibit-portal/xp-secrets.tf
@@ -160,4 +160,34 @@ resource "aws_secretsmanager_secret" "domainadmin-aladmin" {
 POLICY
 
   tags = local.tags
-}
\ No newline at end of file
+}
+
+resource "aws_secretsmanager_secret" "ingest_root_ca_cert" {
+  name        = "${local.environment}/ingest-root-ca-cert"
+  description = "Root CA certificate data for the Ingest service"
+  policy      = <<POLICY
+{
+  "Version" : "2012-10-17",
+  "Statement" : [ {
+    "Sid" : "AdministratorFullAccess",
+    "Effect" : "Allow",
+    "Principal" : {
+      "AWS" : "${sort(data.aws_iam_roles.admin.arns)[0]}"
+    },
+    "Action" : "secretsmanager:*",
+    "Resource" : "*"
+  },
+  {
+    "Sid" : "MPDeveloperFullAccess",
+    "Effect" : "Allow",
+    "Principal" : {
+       "AWS" : "${sort(data.aws_iam_roles.developer.arns)[0]}"
+    },
+    "Action" : "secretsmanager:*",  
+    "Resource" : "*"
+  } ]
+}
+POLICY
+
+  tags = local.tags
+}