{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "ssm:GetParameter"
        ],
        "Resource": [
            "${github_app_webhook_secret_arn}"
        ]
    %{ if kms_key_arn != "" ~}
    },
    {
        "Effect": "Allow",
        "Action": [
            "kms:Decrypt"
        ],
        "Resource": "${kms_key_arn}"
    %{ endif ~}
    }
  ]
}