From 710f8c3a05556b89af9f60ef0316501f254fada4 Mon Sep 17 00:00:00 2001
From: KarlMoores <292835949+karlmcgi@users.noreply.github.com>
Date: Fri, 21 Aug 2026 14:20:34 +0100
Subject: [PATCH] CCM-23022: Switching sts session arn to IAM role arn in KMS
 key policy as sessions with wildcards are unsupported

---
 infrastructure/terraform/modules/aws-backup-source/kms.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infrastructure/terraform/modules/aws-backup-source/kms.tf b/infrastructure/terraform/modules/aws-backup-source/kms.tf
index dd5a5bf..fbc96ea 100644
--- a/infrastructure/terraform/modules/aws-backup-source/kms.tf
+++ b/infrastructure/terraform/modules/aws-backup-source/kms.tf
@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "backup_key_policy" {
     sid = "EnableIAMUserPermissions"
     principals {
       type        = "AWS"
-      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", "arn:aws:sts::${data.aws_caller_identity.current.account_id}:assumed-role/GitHub_Deploy/*"]
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/service-role/GitHub_Deploy"]
     }
     actions   = ["kms:*"]
     resources = ["*"]