Output function role ARN

[maclennann]

It would be great if the Cloudformation templates for these functions would output the ARN of the role that was created for inclusion in resource policies on the secrets.

Right now the best option I've found is to check userid ~= "*:[rotator function name]" as in

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "secretsmanager:UpdateSecretVersionStage",
        "secretsmanager:PutSecretValue",
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:userid": [
            "AROASECRETADMINROLE:*",
            "*:name-of-rotator-function"
          ]
        }
      }
    }
  ]
}

Which, for all the protection that provides I just might as well not have a secret policy.

[joebaro]

Thank you for your feedback. We have noted this as a feature request.