[PLT-1425] Add the key used to decrypt cdap sops files to correct failed workflow

terraform/services/github-actions-role/data.tf

@@ -23,13 +23,20 @@ locals {
       "web-admin",
     ] : [],
   )
+
+  # TODO Replace with cdap-test and cdap-prod when those environments are set up
+  account_env = contains(["dev", "test"], var.env) ? "bcda-test" : "bcda-prod"
 }
 
 # KMS keys needed for IAM policy
 data "aws_kms_alias" "environment_key" {
   name = "alias/${var.app}-${var.env}"
 }
 
+data "aws_kms_alias" "account_env" {
+  name = "alias/${local.account_env}"
+}
+
 data "aws_kms_alias" "ab2d_tfstate_bucket" {
   count = var.env == "ab2d" ? 1 : 0
   name  = "alias/ab2d-${var.env}-tfstate-bucket"

terraform/services/github-actions-role/main.tf

@@ -278,6 +278,7 @@ data "aws_iam_policy_document" "github_actions_policy" {
     ]
     resources = concat(
       [data.aws_kms_alias.environment_key.arn],
+      [data.aws_kms_alias.account_env.arn],
       var.app == "ab2d" ? concat(
         data.aws_kms_alias.ab2d_ecr[*].arn,
         data.aws_kms_alias.ab2d_tfstate_bucket[*].arn,