[PRMT-2395] Add missing CIEnvLinker permissions

Author: oktawia-kata-nhs

terraform-cross-account/iam-ci/iam_gocd.tf

@@ -43,10 +43,21 @@ data "aws_iam_policy_document" "cross_ci_ssm" {
   statement {
     effect = "Allow"
     actions = [
-      "ssm:GetParameter"
+      "ssm:GetParameter*",
+      "ssm:ListTagsForResource",
+      "ssm:PutParameter",
+      "ssm:AddTagsToResource"
     ]
     resources = ["arn:aws:ssm:*:327778747031:parameter/*"]
   }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:DescribeParameters",
+    ]
+    resources = ["arn:aws:ssm:*:327778747031:*"]
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "ci_to_env_linker_write" {
@@ -77,9 +88,10 @@ data "aws_iam_policy_document" "cross_ci_write" {
     actions = [
       "route53:DisassociateVPCFromHostedZone",
       "route53:AssociateVPCWithHostedZone",
+      "route53:ListTagsForResource",
       "route53:ChangeResourceRecordSets",
       "route53:DeleteVPCAssociationAuthorization",
-      "route53:CreateVPCAssociationAuthorization"
+      "route53:CreateVPCAssociationAuthorization",
     ]
     resources = ["arn:aws:route53:::hostedzone/*"]
   }

terraform/main.tf

@@ -8,7 +8,7 @@ provider "aws" {
   region  = var.region
   assume_role {
     role_arn     = "arn:aws:iam::${var.common_account_id}:role/${var.common_account_role}"
-    session_name = "common-dev-cross-account"
+    session_name = "common-${var.environment}-cross-account"
   }
 }