fix(ci): let the runner plan role refresh cluster resources (#182)

lib/actions-runner-hcptf-stack.ts

@@ -442,20 +442,43 @@ function planPolicy(hcpArn: string, githubArn: string): object {
           "iam:GetRole",
           "iam:GetRolePolicy",
           "iam:ListAttachedRolePolicies",
+          "iam:ListPolicyTags",
           "iam:ListRolePolicies",
+          "iam:ListRoleTags",
         ],
         Resource: [
           `arn:aws:iam::${ACCOUNT}:role/actions-runner*`,
           `arn:aws:iam::${ACCOUNT}:role/tf-managed/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner`,
           `arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner-plan`,
           `arn:aws:iam::${ACCOUNT}:role/githubdeploy-seahaven-org-baseline`,
           `arn:aws:iam::${ACCOUNT}:policy/actions-runner*`,
           `arn:aws:iam::${ACCOUNT}:policy/tf-managed/*`,
+          `arn:aws:iam::${ACCOUNT}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/*`,
           hcpArn,
           githubArn,
         ],
       },
+      {
+        Sid: "CollectionReads",
+        Effect: "Allow",
+        Action: ["kms:ListAliases", "ssm:DescribeParameters"],
+        Resource: "*",
+      },
+      {
+        Sid: "EcrReads",
+        Effect: "Allow",
+        Action: [
+          "ecr:DescribeRepositories",
+          "ecr:GetLifecyclePolicy",
+          "ecr:GetRepositoryPolicy",
+          "ecr:ListTagsForResource",
+        ],
+        Resource: `arn:aws:ecr:us-east-1:${ACCOUNT}:repository/actions-runner`,
+      },
       {
         Sid: "EksAccessReads",
         Effect: "Allow",