        {
            "Sid": "SecretsManagerRead",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Effect": "Allow",
            "Resource": [
            {%- for secret_name in items %}
                "arn:aws:secretsmanager:{{ region }}:{{ account_number }}:secret:{{ secret_name }}"
                {%- if not loop.last -%}
                ,
                {%- endif -%}
            {% endfor %}
            ]
        }
