# SecretStore for AWS Secrets Manager
# This configures External Secrets Operator to fetch secrets from AWS Secrets Manager

apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-secrets-aws
  namespace: veza-production
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/veza-external-secrets-role
---
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-store
  namespace: veza-production
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-aws

