fix: DescribeParameter always needs full access

[jaydeland]

Description

Just like ListSecrets from Secrets Manager the DecribeParameter action is always required to allow full access

Motivation and Context

With out this the policy will not work when using the external_secrets_ssm_parameter_arns variable

Breaking Changes

no

How Has This Been Tested?

• I have tested and validated these changes using my fork as a module
• I have executed pre-commit run -a on my pull request

[jaydeland]

pre-commit run -a
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed

[jaydeland]

@bryantbiggs This is a follow up to: #348

[jaydeland]

This is the final policy json when setting external_secrets_ssm_parameter_arns and external_secrets_secrets_manager_arns

{
    "Statement": [
        {
            "Action": "ssm:DescribeParameters",
            "Effect": "Allow",
            "Resource": "*",
            "Sid": ""
        },
        {
            "Action": [
                "ssm:GetParameters",
                "ssm:GetParameter"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:ssm:*:*:parameter/eso/*",
            "Sid": ""
        },
        {
            "Action": "secretsmanager:ListSecrets",
            "Effect": "Allow",
            "Resource": "*",
            "Sid": ""
        },
        {
            "Action": [
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:GetSecretValue",
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:DescribeSecret"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:secretsmanager:*:*:secret:/eso/*",
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}

[bryantbiggs]

I had thought it was going to require wildcard, at least we tried to scope it! Thanks for the PR!

[antonbabenko]

This PR is included in version 5.14.4 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.