fix: Add ssm:DescribeParameters permission to external-secrets IAM role for service account (IRSA)

[jaydeland]

ssm:DescribeParameters is required to sync secrets from ParameterStore

Description

Error from the external-secrets log:
aws-role is not authorized to perform: ssm:DescribeParameters on resource: * because no identity-based policy allows the ssm:DescribeParameters action\n\tstatus code: 400, request id: ff","stacktrace":"github.com/external-secrets/external-secrets/pkg/controllers/e │

Motivation and Context

When using AWS System Manager Parameters with external-secrets(ESO) the secrets can not be synced unless the AWS Role that is mapped to the EKS Service Account has the ssm:DescribeParameters action.

Breaking Changes

How Has This Been Tested?

1. Using the module: "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
2. provider: aws
3. ESO SecretStore with

spec:
  provider:
    aws:
      service: ParameterStore
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: <sa_name>

4. Other values passed to the module

attach_external_secrets_policy = true
allow_self_assume_role = true

• I have executed pre-commit run -a on my pull request

pre-commit run -a
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed

[jaydeland]

@antonbabenko or @bryantbiggs - Am I missing anything else to get this PR approved?

[bryantbiggs]

are you sure this will work or does it need to be a wildcard? aws-ia/terraform-aws-eks-blueprints#1504

[jaydeland]

are you sure this will work or does it need to be a wildcard? aws-ia/terraform-aws-eks-blueprints#1504

• If I follow the code correctly this change should be an addition to the action block that uses the var.external_secrets_ssm_parameter_arns varaible as the resource

  terraform-aws-iam/modules/iam-role-for-service-accounts-eks/policies.tf

  Line 440 in a53a091

  resources = var.external_secrets_ssm_parameter_arns

• The var.external_secrets_ssm_parameter_arns varaible defaults to ["arn:aws:ssm:*:*:parameter/*"]:

  terraform-aws-iam/modules/iam-role-for-service-accounts-eks/variables.tf

  Line 158 in a53a091

  default = ["arn:aws:ssm:*:*:parameter/*"]

[bryantbiggs]

seems safe enough to try as is since the ARNs are in the users control - thank you!

[antonbabenko]

This PR is included in version 5.14.2 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.