feat: add read permission for savings plans

[gcharest]

Summary | Résumé

This pull request adds a new permission to the AWS IAM policy document for read-only billing. Specifically, it allows listing recommended actions for AWS Savings Plans, which can help users access cost optimization recommendations.

Permissions update:

• Added a new statement to the aws_iam_policy_document.read_only_billing policy to allow the bcm-recommended-actions:ListRecommendedActions action, enabling users to view Savings Plans recommendations.

[github-actions]

Plan for org_account/sentinel_oidc

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_iam_openid_connect_provider.azure

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_openid_connect_provider.azure will be updated in-place
  ~ resource "aws_iam_openid_connect_provider" "azure" {
        id              = "arn:aws:iam::659087519042:oidc-provider/sts.windows.net/221ca1d3-b3f2-4346-8abc-88f802495c7d/"
        tags            = {}
      ~ thumbprint_list = [
          - "626d44e704d1ceabe3bf0d53397464ac8080142c",
          + "1b511abead59c6ce207077c0bf0e0043b1382612",
        ]
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_iam_openid_connect_provider.azure"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.sentinel_oidc"]

21 tests, 19 passed, 2 warnings, 0 failures, 0 exceptions

[github-actions]

Plan for org_account/iam_identity_center

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_ssoadmin_permission_set_inline_policy.read_only_billing

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_ssoadmin_permission_set_inline_policy.read_only_billing will be updated in-place
  ~ resource "aws_ssoadmin_permission_set_inline_policy" "read_only_billing" {
        id                 = "arn:aws:sso:::permissionSet/ssoins-8824c710b5ddb452/ps-155a8dac774b6771,arn:aws:sso:::instance/ssoins-8824c710b5ddb452"
      ~ inline_policy      = jsonencode(
          ~ {
              ~ Statement = [
                    # (1 unchanged element hidden)
                    {
                        Action   = [
                            "ce:List*",
                            "ce:Get*",
                            "ce:Describe*",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "CostExplorerRead"
                    },
                  + {
                      + Action   = "bcm-recommended-actions:ListRecommendedActions"
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "SavingsPlansRead"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.admin_pinpoint_sms"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.admin_route53_notify_hosted_zone"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.admin_s3_website_assets"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.admin_support_center"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.athena_query_access"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.canadian_digital_service_production_website_admin"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.cra_bucket_get_object"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.notify_access_ecs_blazer"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.quicksight"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.rds_query_access"]
WARN - plan.json - main - Missing Common Tags: ["aws_ssoadmin_permission_set.read_only_billing"]

30 tests, 19 passed, 11 warnings, 0 failures, 0 exceptions