remove jbid stuff

terraform-modules · Mar 24, 2026 · 7ece04c · 7ece04c
1 parent b2068fe
commit 7ece04c
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 17 deletions.
diff --git a/policies/sc-dbuser/.terraform.lock.hcl b/policies/sc-dbuser/.terraform.lock.hcl
diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
@@ -76,29 +76,13 @@ data "aws_iam_policy_document" "inline" {
     ]
   }
   statement {
-    sid       = "AllowSecretsManagerReadByJBID"
+    sid       = "AllowSecretsManagerRead"
     effect    = "Allow"
     resources = ["*"]
     actions = [
       "secretsmanager:BatchGetSecretValue",
       "secretsmanager:DescribeSecret",
       "secretsmanager:GetSecretValue",
     ]
-    # Secret must be tagged to the same JBID as the caller.
-    condition {
-      test     = "StringEquals"
-      variable = "secretsmanager:ResourceTag/jbid"
-      values = [
-        "$${aws:PrincipalTag/jbid}"
-      ]
-    }
-    # Name tag pattern includes the caller identifier.
-    condition {
-      test     = "StringLike"
-      variable = "secretsmanager:ResourceTag/Name"
-      values = [
-        "*$${aws:PrincipalTag/jbid}*"
-      ]
-    }
   }
 }