fix(codebuild): add secretsmanager:GetResourcePolicy to CodeBuild role

CSVD · Mar 18, 2026 · d1da026 · d1da026
1 parent 7611855
commit d1da026
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/codebuild/main.tf b/codebuild/main.tf
@@ -57,6 +57,9 @@ data "aws_iam_policy_document" "ghe_runner_deploy" {
       "secretsmanager:UpdateSecret",
       "secretsmanager:DeleteSecret",
       "secretsmanager:TagResource",
+      "secretsmanager:GetResourcePolicy",
+      "secretsmanager:PutResourcePolicy",
+      "secretsmanager:DeleteResourcePolicy",
     ]
     # The ghe-runner module stores tokens under this prefix
     resources = [