Move Lambda Vars to Parameter Store

modules/runners/policies-runner.tf

@@ -25,7 +25,10 @@ resource "aws_iam_role_policy" "ssm_parameters" {
   role = aws_iam_role.runner.name
   policy = templatefile("${path.module}/policies/instance-ssm-parameters-policy.json",
     {
-      arn_ssm_parameters = "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*"
+      arns = [
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*",
+        "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*"
+      ]
     }
   )
 }
@@ -46,4 +49,4 @@ resource "aws_iam_role_policy_attachment" "managed_policies" {
   policy_arn = element(var.runner_iam_role_managed_policy_arns, count.index)
 }
 
-// see also logging.tf for logging and metrics policies
+// see also logging.tf for logging and metrics policies

modules/runners/policies/instance-ssm-parameters-policy.json

@@ -3,16 +3,26 @@
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": ["ssm:DeleteParameter"],
-      "Resource": "${arn_ssm_parameters}"
+      "Action": [
+        "ssm:DeleteParameter"
+      ],
+      "Resource": [
+        %{~ for arn in arns ~}
+        "${arn_ssm_parameters}"
+        %{~ endfor ~}
+      ]
     },
     {
       "Effect": "Allow",
       "Action": [
         "ssm:GetParameters",
         "ssm:GetParameter"
       ],
-      "Resource": "${arn_ssm_parameters}"
+      "Resource": [
+        %{~ for arn in arns ~}
+        "${arn_ssm_parameters}"
+        %{~ endfor ~}
+      ]
     }
   ]
 }