fix(deleter): add missing parameter store permissions

[kschelonka]

Adds missing permissions to some shared secrets

[github-actions]

Plan Result (@infrastructure/account-data-deleter-production)

CI link

Plan: 0 to add, 1 to change, 0 to destroy.

• Update
  • aws_iam_policy.data-deleter-app_application_ecs_service_ecs-iam_ecs-task-execution-role-policy_B4FDF02D

Change Result (Click me)

  # aws_iam_policy.data-deleter-app_application_ecs_service_ecs-iam_ecs-task-execution-role-policy_B4FDF02D will be updated in-place
  ~ resource "aws_iam_policy" "data-deleter-app_application_ecs_service_ecs-iam_ecs-task-execution-role-policy_B4FDF02D" {
        id               = "arn:aws:iam::996905175585:policy/AccountDataDeleter-Prod-TaskExecutionRolePolicy"
        name             = "AccountDataDeleter-Prod-TaskExecutionRolePolicy"
      ~ policy           = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "secretsmanager:GetSecretValue",
                            "kms:Decrypt",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:Shared/*",
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:Shared",
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter/Prod/*",
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter/Prod",
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter-Prod/*",
                            "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter-Prod",
                            "arn:aws:kms:us-east-1:996905175585:key/fee9bd90-a01f-4212-8b69-9c149a7cdb15",
                        ]
                    },
                  ~ {
                      ~ Resource = [
                          + "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_SECRET",
                          + "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_ID",
                          + "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_AUTH_OAUTH_URL",
                            "arn:aws:ssm:us-east-1:996905175585:parameter/Shared/*",
                            # (2 unchanged elements hidden)
                        ]
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags             = {
            "app_code"       = "pocket"
            "component_code" = "pocket-accountdatadeleter"
            "costCenter"     = "Pocket"
            "env_code"       = "prod"
            "environment"    = "Prod"
            "owner"          = "Pocket"
            "service"        = "AccountDataDeleter"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

⚠️ Errors

• add a label @infrastructure/account-data-deleter-production/add-or-update: POST https://api.github.com/repos/Pocket/pocket-monorepo/issues/1038/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

[nzeltzer]

lgtm