[DPE-1521] Add IAM permission to update OIDC provider thumbprints

[linglp]

Problem:

Spacelift authenticates to AWS using OIDC, which allows Spacelift to assume the spacelift-admin-role and deploy resources for us on AWS. When I tried to deploy resources to our staging environment, I encountered the error:

module.sage-aws-eks.module.eks.aws_eks_addon.this["vpc-cni"]: Modifications complete after 35s [id=dpe-k8-staging:vpc-cni]
╷
│ Error: updating IAM OIDC Provider (arn:aws:iam::766808016710:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/A6862702CE6F43346EADA1179CD48D27) thumbprint: operation error IAM: UpdateOpenIDConnectProviderThumbprint, https response error StatusCode: 403, RequestID: 118e0b53-3561-4247-a6ca-d8ccb5cd3c07, api error AccessDenied: User: arn:aws:sts::766808016710:assumed-role/spacelift-admin-role/01KCPPZY8HK2A7TXPMYAJT8F8A@dpe-staging-kubernetes-infrastructure is not authorized to perform: iam:UpdateOpenIDConnectProviderThumbprint on resource: arn:aws:iam::766808016710:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/A6862702CE6F43346EADA1179CD48D27 because no identity-based policy allows the iam:UpdateOpenIDConnectProviderThumbprint action
│ 
│   with module.sage-aws-eks.module.eks.aws_iam_openid_connect_provider.oidc_provider[0],
│   on .terraform/modules/sage-aws-eks.eks/main.tf line 419, in resource "aws_iam_openid_connect_provider" "oidc_provider":
│  419: resource "aws_iam_openid_connect_provider" "oidc_provider" {
│ 
╵

This shows that spacelift-admin-role lacks the iam:UpdateOpenIDConnectProviderThumbprint permission, which is needed to update the list of server certificate thumbprints associated with an OpenID Connect (OIDC) provider resource.

Solution

Add IAM action: iam:UpdateOpenIDConnectProviderThumbprint

[BryanFauble]

Verified changes and added them to the IAM Policy