Missing permissions in deepwatch-mdr-role

[ZacharyWallace]

Since the migration from the ABI templates to the SRA templates various changes in how the Cloudtrail bucket is implemented causes issues with the policy on the role created for cross-account assumption, including the following:

• Versioning is enabled: s3:GetObjectVersion is needed
• KMS-encrypted bucket objects: kms:Decrypt needed on IAM policy and key policy similar to below required on the KMS key used for encryption

  "Sid": "Allow use of the key",
  "Effect": "Allow",
  "Principal": {"AWS": [
    "arn:aws:iam::0123456789:role/deepwatch-mdr-role" 
  ]},
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:ReEncrypt*",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "$KMS-ARN"
}

Additional reports of permissions potentially being needed: sqs:ChangeMessageVisibility & s3:ListBucket