Merge pull request #8122 from ministryofjustice/fix/7607-more-ssm-adj…

…ustments More fixes for ssm params
ministryofjustice · Sep 30, 2024 · 1f0a902 · 1f0a902
2 parents 72f0013 + f026759
commit 1f0a902
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/terraform/environments/core-logging/cortex.tf b/terraform/environments/core-logging/cortex.tf
@@ -156,7 +156,7 @@ data "aws_iam_policy_document" "cortex_trust_policy" {
 
     principals {
       type        = "AWS"
-      identifiers = ["arn:aws:iam::${aws_ssm_parameter.cortex_account_id.value}:root"]
+      identifiers = ["arn:aws:iam::${aws_ssm_parameter.cortex_account_id.insecure_value}:root"]
       # Palo Alto Cortex AWS Account ID
       # Taken from https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-an-Assumed-Role
     }

diff --git a/terraform/environments/core-logging/ssm.tf b/terraform/environments/core-logging/ssm.tf
@@ -1,7 +1,7 @@
 resource "aws_ssm_parameter" "cortex_account_id" {
   #checkov:skip=CKV2_AWS_34: "Parameter is not sensitive; account ID is publicly available."
   lifecycle {
-    ignore_changes = [value]
+    ignore_changes = [insecure_value]
   }
   provider       = aws.modernisation-platform
   description    = "Account ID for Palo Alto Cortex XSIAM cross-account role."
@@ -16,6 +16,7 @@ resource "aws_ssm_parameter" "core_logging_bucket_arns" {
   provider    = aws.modernisation-platform
   description = "Bucket ARNs in core-logging for Palo Alto Cortex XSIAM."
   name        = "core_logging_bucket_arns"
+  overwrite   = true
   type        = "String"
   insecure_value = jsonencode({
     for key in local.cortex_logging_buckets :