fix: External-secrets // fix IAM permissions for SA

[daniel-ciaglia]

ssm:DescribeParameters seems to need a resource wildcard

What does this PR do?

Adds IAM permission for external-secrets SA to allow use of ssm:DescribeParameters on wildcard resource.

Motivation

• Resolves kubernetes-addons/external-secrets // SA IAM permissions need wildcard to use find.path feature terraform-aws-eks-blueprints-addons#75

More

• Yes, I have tested the PR using my local account setup (Provide any test evidence report under Additional Notes)
• Yes, I have updated the docs for this feature
  • not needed
• Yes, I ran pre-commit run -a with this PR

For Moderators

• E2E Test successfully complete before merge?

Additional Notes

TF plan run

  # module.eks_blueprints_kubernetes_addons.module.external_secrets[0].aws_iam_policy.external_secrets will be updated in-place
  ~ resource "aws_iam_policy" "external_secrets" {
        id          = "arn:aws:iam::<account>:policy/eks-external-secrets-irsa"
        name        = "eks-external-secrets-irsa"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = "arn:aws:ssm:*:*:parameter/*" -> [
                          + "arn:aws:ssm:eu-central-1:<account>:parameter/*",
                          + "arn:aws:ssm:*:*:parameter/*",
                        ]
                        # (3 unchanged elements hidden)
                    },
                  ~ {
                      ~ Resource = "arn:aws:secretsmanager:*:*:secret:*" -> [
                          + "arn:aws:secretsmanager:eu-central-1:<account>:secret:*",
                          + "arn:aws:secretsmanager:*:*:secret:*",
                        ]
                        # (3 unchanged elements hidden)
                    },
                  + {
                      + Action   = "ssm:DescribeParameters"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:eu-central-1:<account>:*"
                      + Sid      = ""
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

[bryantbiggs]

thank you for the PR - any changes to the addons should be submitted to the new repository https://github.com/aws-ia/terraform-aws-eks-blueprints-addons