Update provider to modernisation-secrets-read and add modernisation-secrets-read provider

terraform/environments/analytical-platform-common/providers.tf

@@ -31,3 +31,12 @@ provider "aws" {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
 }
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-common/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
 }
+

terraform/environments/analytical-platform-compute/providers.tf

@@ -31,3 +31,12 @@ provider "aws" {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
 }
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-compute/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
 }
+

terraform/environments/analytical-platform-data-engineering/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-data-engineering/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/analytical-platform-data/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-data/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/analytical-platform-ingestion/providers.tf

@@ -31,3 +31,12 @@ provider "aws" {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
 }
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-ingestion/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
 }
+

terraform/environments/analytical-platform-landing/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-landing/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/analytical-platform-management/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform-management/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/analytical-platform/providers.tf

@@ -34,4 +34,13 @@ provider "aws" {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
   default_tags { tags = local.tags }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/analytical-platform/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/apex/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/apex/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
-}
+}
+

terraform/environments/bacway/providers.tf

@@ -31,3 +31,12 @@ provider "aws" {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
 }
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}

terraform/environments/bacway/secrets.tf

@@ -1,16 +1,18 @@
 # Get modernisation account id from ssm parameter
 data "aws_ssm_parameter" "modernisation_platform_account_id" {
+  provider = aws.modernisation-platform
   name = "modernisation_platform_account_id"
 }
 
 # Get secret by arn for environment management
 data "aws_secretsmanager_secret" "environment_management" {
-  provider = aws.modernisation-platform
+  provider = aws.modernisation-secrets-read
   name     = "environment_management"
 }
 
 # Get latest secret value with ID from above. This secret stores account IDs for the Modernisation Platform sub-accounts
 data "aws_secretsmanager_secret_version" "environment_management" {
-  provider  = aws.modernisation-platform
+  provider  = aws.modernisation-secrets-read
   secret_id = data.aws_secretsmanager_secret.environment_management.id
 }
+

terraform/environments/bichard7/providers.tf

@@ -30,4 +30,13 @@ provider "aws" {
   assume_role {
     role_arn = "arn:aws:iam::${local.environment_management.account_ids["core-network-services-production"]}:role/ModernisationPlatformAccess"
   }
-}
+}
+
+# AWS provider (modernisation-secrets-read): Required for assuming a role into modernisation platform account to read secrets
+provider "aws" {
+  alias  = "modernisation-secrets-read"
+  region = "eu-west-2"
+  assume_role {
+    role_arn = "arn:aws:iam::${data.aws_ssm_parameter.modernisation_platform_account_id.value}:role/modernisation-account-limited-read-member-access"
+  }
+}