From 7ece04ca0c11ef9433dfb79e93f051c52ef4b8bc Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Tue, 24 Mar 2026 14:58:53 -0400
Subject: [PATCH] remove jbid stuff

---
 policies/sc-dbuser/.terraform.lock.hcl | 25 +++++++++++++++++++++++++
 policies/sc-dbuser/policy.tf           | 18 +-----------------
 2 files changed, 26 insertions(+), 17 deletions(-)
 create mode 100644 policies/sc-dbuser/.terraform.lock.hcl

diff --git a/policies/sc-dbuser/.terraform.lock.hcl b/policies/sc-dbuser/.terraform.lock.hcl
new file mode 100644
index 0000000..32cc8cc
--- /dev/null
+++ b/policies/sc-dbuser/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.37.0"
+  constraints = ">= 6.0.0"
+  hashes = [
+    "h1:w3z/TApcKD3b/aMZoZZKSxOld4xw+gEtQ1ka6C1UN+4=",
+    "zh:0427fadb719ed5a32feb09f047539d2348e659056f3b8a8589d34d8f0a95be7a",
+    "zh:3891c670674aba2125a7ac6d4348cde43646b1b46ce6f829e6f4724091bc0dcd",
+    "zh:632cb24b7b5790b730b33bcbe9f1a7b75f2644fb52f9d6aaafb0249c9e7601d2",
+    "zh:6e96ed1f824c2efa9de5b7c22ab3715624ba34c28564a06e9a15e71bc3d3a30b",
+    "zh:7b8fd86907b659bc45f4a3f42c3c0ccc66925a74e265b01e9e66242c0b2cafef",
+    "zh:81f9a587deddef4dfcc2101c54ec28a3a554056837f68ebb920c83fe8327b16f",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:a9a38a67cb98d690fec951ec3e133b6836279629db2ed3a0ebf97a5bea58674f",
+    "zh:b18f60d62e4bd4d466077e09c39259d1a85355f0f00b801fe8aedbc50193d357",
+    "zh:b7a51bc0faf60d17043b4df1d1b7bb55129eaa4bdeb65ff55f5b00b9b8fee9f7",
+    "zh:c28c42f91ca3a6b65b3fd3ed6e891fc0fc28d0cb5ab65dea65eda8eec5cea5f3",
+    "zh:d895ddc04280ed26b6ca64ca05b78caaa7b72c8e167af4093545efbc608d5482",
+    "zh:f4a56f5157009ef160fbd79105078fe675df479cb73c1b7e1fea2741403a0b67",
+    "zh:f547d6ca371b96fec97b972fc0c93bcfc23d58e34a9da215b94e9d2aa170fb77",
+    "zh:f7b0a3cd4adadd3f4b9609a54e651ed5eafa22c196ab229042fc1d0aa0ab8f3a",
+  ]
+}
diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
index 0f09dc0..8dc4ab1 100644
--- a/policies/sc-dbuser/policy.tf
+++ b/policies/sc-dbuser/policy.tf
@@ -76,7 +76,7 @@ data "aws_iam_policy_document" "inline" {
     ]
   }
   statement {
-    sid       = "AllowSecretsManagerReadByJBID"
+    sid       = "AllowSecretsManagerRead"
     effect    = "Allow"
     resources = ["*"]
     actions = [
@@ -84,21 +84,5 @@ data "aws_iam_policy_document" "inline" {
       "secretsmanager:DescribeSecret",
       "secretsmanager:GetSecretValue",
     ]
-    # Secret must be tagged to the same JBID as the caller.
-    condition {
-      test     = "StringEquals"
-      variable = "secretsmanager:ResourceTag/jbid"
-      values = [
-        "$${aws:PrincipalTag/jbid}"
-      ]
-    }
-    # Name tag pattern includes the caller identifier.
-    condition {
-      test     = "StringLike"
-      variable = "secretsmanager:ResourceTag/Name"
-      values = [
-        "*$${aws:PrincipalTag/jbid}*"
-      ]
-    }
   }
 }