Manage member account AWS SSM settings centrally

User Story

There are several settings for SSM such as KMS encryption and sending logs to cloudwatch that we want to manage centrally. A user of the platform tried to amend these to improve the security and logging for SSM, but found they did not have the required permissions, but this has highlighted this to us as something we a) need to improve, and b) want to manage centrally to ensure standards are followed and consistent across the platform.

Value

This ensures that security settings or logs for SSM cannot be disabled by application teams and settings are consistent across the platform.

Questions / Assumptions

Review the SSM settings and decide on platform appropriate values to manage them centrally. Also then properly lock down the ability to change these for end users. (All of these are open for the MemberInfrastructureAccess role to amend, it was only a missing kms key role for the developer connecting via SSM that prevented the changes)

See example of what the user wanted to do here - https://github.com/ministryofjustice/modernisation-platform-environments/pull/212/files

Definition of done

[ ] Review the SSM settings and decide on platform appropriate values
[ ] SSM settings managed centrally (baselines module?)
[ ] MemberInfrastructureAccess role permissions for accounts for SSM are locked down
[ ] Docs have been updated (user-guide, module readme)

Reference

How to write good user stories

ministryofjustice / modernisation-platform