{
  // Allows creating, updating, and deleting individual secrets within vault
  "id": "vault/data-write",
  "description": "Allows creating, updating, and deleting individual secrets within vault",
  "platforms": {
    "aws": [
      {
        "grant": {
          "actions": ["ssm:PutParameter", "ssm:DeleteParameter"]
        },
        "binding": {
          "stack": {
            "resources": ["arn:aws:ssm:${awsRegion}:${awsAccountId}:parameter/${stackPrefix}-*"]
          },
          "resource": {
            "resources": [
              "arn:aws:ssm:${awsRegion}:${awsAccountId}:parameter/${stackPrefix}-${resourceName}-*"
            ]
          }
        }
      }
    ],
    "gcp": [
      {
        "grant": {
          "permissions": [
            "secretmanager.versions.access",
            "secretmanager.secrets.get",
            "secretmanager.secrets.create",
            "secretmanager.versions.add",
            "secretmanager.secrets.delete"
          ]
        },
        "binding": {
          "stack": {
            "scope": "projects/${projectName}",
            "condition": {
              "title": "Vault data write access",
              "expression": "resource.type == 'secretmanager.googleapis.com/Secret' && resource.name.startsWith('projects/${projectName}/secrets/${stackPrefix}-')"
            }
          },
          "resource": {
            "scope": "projects/${projectName}",
            "condition": {
              "title": "Vault data write access",
              "expression": "resource.type == 'secretmanager.googleapis.com/Secret' && resource.name.startsWith('projects/${projectName}/secrets/${stackPrefix}-${resourceName}-')"
            }
          }
        }
      }
    ],
    "azure": [
      {
        "grant": {
          "actions": [
            "Microsoft.KeyVault/vaults/secrets/read",
            "Microsoft.KeyVault/vaults/secrets/write",
            "Microsoft.KeyVault/vaults/secrets/delete"
          ]
        },
        "binding": {
          "stack": {
            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.KeyVault/vaults/${stackPrefix}-*"
          },
          "resource": {
            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.KeyVault/vaults/${stackPrefix}-${resourceName}"
          }
        }
      }
    ]
  }
}
