diff --git a/root_export_bucket_access.tf b/root_export_bucket_access.tf
new file mode 100644
index 00000000..37f43275
--- /dev/null
+++ b/root_export_bucket_access.tf
@@ -0,0 +1,25 @@
+
+module "aws_sso_roles" {
+  source = "./da-terraform-modules/ssm_parameter"
+  parameters = [
+    {
+      name        = "${local.environment}/admin_role",
+      description = "AWS SSO admin role. Value to be added manually"
+      type        = "SecureString"
+      value       = "placeholder"
+    },
+    {
+      name        = "${local.environment}/developer_role",
+      description = "AWS SSO developer role. Value to be added manually"
+      type        = "SecureString"
+      value       = "placeholder"
+    },
+    {
+      name        = "${local.environment}/export_role",
+      description = "AWS SSO export role. Value to be added manually"
+      type        = "SecureString"
+      value       = "placeholder"
+    }
+  ]
+  tags = local.common_tags
+}