Add ssm:GetParametersByPath (#5)

README.md

@@ -33,7 +33,7 @@ module "chamber_user" {
 | `force_destroy` | `false` | Destroy even if it has non-Terraform-managed IAM access keys, login profiles or MFA devices |    No    |
 | `path`          |   `/`   | Path in which to create the user                                                            |    No    |
 | `enabled`       | `true`  | Set to `false` to prevent the module from creating any resources                            |    No    |
-| `ssm_actions`   | `["ssm:DescribeParameters","ssm:GetParameters"]`   | Actions to allow in the policy                   |    No    |
+| `ssm_actions`   | `["ssm:GetParametersByPath", "ssm:GetParameters"]`   | Actions to allow in the policy                   |    No    |
 | `ssm_resources` | `["*"]` | Resources to apply the actions specified in the policy                                      |    No    |
 
 

main.tf

@@ -1,18 +1,20 @@
 data "aws_iam_policy_document" "default" {
   statement {
-    actions = ["${var.ssm_actions}"]
+    actions   = ["ssm:DescribeParameters"]
+    resources = ["*"]
+    effect    = "Allow"
+  }
 
+  statement {
+    actions   = ["${var.ssm_actions}"]
     resources = ["${var.ssm_resources}"]
+    effect    = "Allow"
   }
 
   statement {
-    actions = [
-      "kms:Decrypt",
-    ]
-
-    resources = [
-      "${var.kms_key_arn}",
-    ]
+    actions   = ["kms:Decrypt"]
+    resources = ["${var.kms_key_arn}"]
+    effect    = "Allow"
   }
 }
 

variables.tf

@@ -37,7 +37,7 @@ variable "kms_key_arn" {
 
 variable "ssm_actions" {
   type        = "list"
-  default     = ["ssm:DescribeParameters", "ssm:GetParameters"]
+  default     = ["ssm:GetParametersByPath", "ssm:GetParameters"]
   description = "Actions to allow in the policy"
 }