fix: fix the secret arn

Author: berviantoleo

SimplePasswordManagerService.Infra/src/SimplePasswordManagerServiceInfra/SimplePasswordManagerServiceInfraStack.cs

@@ -12,7 +12,11 @@ internal SimplePasswordManagerServiceInfraStack(Construct scope, string id, ISta
       var repository = Repository.FromRepositoryName(this, "spms-ecr", "spms");
 
       // 1.0 Parameters
-      var secret = Amazon.CDK.AWS.SecretsManager.Secret.FromSecretNameV2(this, "ecs-secret", "dev/AppRunner/spms");
+      var secretArn = new CfnParameter(this, "secretArn", new CfnParameterProps {
+        Type = "String",
+        Description = "Full ARN of the Secrets Manager secret (e.g. arn:aws:secretsmanager:<region>:<account>:secret:dev/AppRunner/spms-AbCdEf)"
+      });
+      var secret = Amazon.CDK.AWS.SecretsManager.Secret.FromSecretCompleteArn(this, "ecs-secret", secretArn.ValueAsString);
 
       var imageTag = new CfnParameter(this, "imageTag", new CfnParameterProps {
         Type = "String",
@@ -27,12 +31,11 @@ internal SimplePasswordManagerServiceInfraStack(Construct scope, string id, ISta
           ManagedPolicy.FromAwsManagedPolicyName("service-role/AmazonECSTaskExecutionRolePolicy")
         }
       });
-      // secret.SecretArn from FromSecretNameV2 resolves without the random suffix
-      // that AWS appends (e.g. dev/AppRunner/spms-AbCdEf), so append -* to match it.
+      // Full ARN is passed in as a parameter, so no wildcard suffix is needed.
       taskExecutionRole.AddToPolicy(new PolicyStatement(new PolicyStatementProps {
         Effect = Effect.ALLOW,
         Actions = new[] { "secretsmanager:GetSecretValue" },
-        Resources = new[] { $"{secret.SecretArn}-*" }
+        Resources = new[] { secret.SecretArn }
       }));
 
       // Task Role — runtime permissions for the application

deploy.yml

@@ -18,7 +18,11 @@ steps:
       sourceImageTag: "$(Build.BuildId)"
       repositoryName: "spms"
       pushTag: "$(Build.BuildId)"
-  - script: cd SimplePasswordManagerService.Infra && cdk deploy SimplePasswordManagerServiceInfraStack --parameters "imageTag=$(Build.BuildId)" --require-approval never
+  - script: |
+      cd SimplePasswordManagerService.Infra && cdk deploy SimplePasswordManagerServiceInfraStack \
+        --parameters "imageTag=$(Build.BuildId)" \
+        --parameters "secretArn=$(SPMS_SECRET_ARN)" \
+        --require-approval never
     displayName: CDK Deploy
     env:
       AWS_ACCESS_KEY_ID: $(AWS_ACCESS_KEY_ID)