README: fix Condition in IAM policy

[vtatarin]

Hello community,

I'm updating the IAM policy from README to reflect the actual way how the datasource is accessing secrets, reference

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[fridgepoet]

Thanks @vtatarin can you tell me a little more context about this one?
For example does the current IAM policy's condition create a problem? Can you tell me how to reproduce it?

[vtatarin]

hello @fridgepoet ! The current IAM policy is incorrect: None condition is not allowed by AWS IAM API. secretsmanager:ResourceTag/RedshiftQueryOwner tags do not ever have False value.

You can verify this by deploying a redshift cluster to an AWS account and attaching the IAM policy to Grafana IAM User/Role. The current version of IAM policy will not allow you Grafana to fetch any credentials from Secrets and it can be fixed via making the changes to IAM policy that I purpose in this MR.

Here is a reference to the actual plugin code which filters out secrets with credentials. As you can see, it simply filters the secrets that do have such a label (not with a specific value or so). Basically, my fix allows the current plugin filter in code to work correctly.

[fridgepoet]

Hi @vtatarin thanks for that extra information.

I believe we are not checking for a False value, rather we are just checking the existence of this particular key. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Null

We have a Redshift cluster whose access is set via an IAM User with Secrets Manager and the documented minimal IAM policy and I believe I'm observing Grafana is able to fetch those credentials from Secrets.

Let us know if you have more specific steps about reproducing this issue or if I am missing something!