{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:PutSecretValue",
                "secretsmanager:UpdateSecretVersionStage"
            ],
            "Resource": ${jsonencode([
                for path in secrets_paths :
                    "arn:aws:secretsmanager:${region}:${account_id}:secret:${path}"
                ],
            )},
            "Condition": {
                "StringEquals": {
                    "secretsmanager:resource/AllowRotationLambdaArn": "${lambda_arn}"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue"
            ],
            "Resource": ${jsonencode([
                for path in secrets_paths :
                    "arn:aws:secretsmanager:${region}:${account_id}:secret:${path}"
                ],
            )}
        },
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "kms:ListAliases"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": ${jsonencode(kms_keys_arns)},
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount" : "${account_id}",
                    "kms:ViaService" : "secretsmanager.${region}.amazonaws.com"
                }
            }
        }
    ]
}