Fix Cognito params

FIAP-3SOAT-G15 · Aug 8, 2024 · 3c1b7f4 · 3c1b7f4
1 parent 30a36c7
commit 3c1b7f4
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 17 deletions.
diff --git a/.github/workflows/provision.yml b/.github/workflows/provision.yml
@@ -70,5 +70,5 @@ jobs:
         run: exit 1
 
       - name: Terraform Apply
-        if: (github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch'
+        #if: (github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch'
         run: terraform apply -auto-approve -input=false
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
diff --git a/terraform/secrets.tf b/terraform/secrets.tf
@@ -1,13 +1,9 @@
-module "secrets_manager" {
-  source  = "terraform-aws-modules/secrets-manager/aws"
-  version = "1.1.2"
+module "cognito_ssm_param" {
+  source = "terraform-aws-modules/ssm-parameter/aws"
+  name   = "live/cognito"
+  type   = "String"
 
-  name = "live/cognito"
-
-  ignore_secret_changes   = true
-  recovery_window_in_days = 0
-
-  secret_string = jsonencode({
+  value = jsonencode({
     "issuer-uri"  = "https://cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.user_pool.id}"
     "jwk-set-uri" = "https://cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.user_pool.id}/.well-known/jwks.json"
   })
@@ -24,10 +20,10 @@ resource "aws_iam_policy" "cognito_secrets_read_only_policy" {
       {
         Effect = "Allow"
         Action = [
-          "secretsmanager:DescribeSecret",
-          "secretsmanager:GetSecretValue"
+          "ssm:GetParameter",
+          "ssm:GetParameters"
         ],
-        Resource = module.secrets_manager.secret_arn
+        Resource = module.cognito_ssm_param.ssm_parameter_arn
       }
     ]
   })