Fix ACM policy

Author: farski

iam-roles/PRX-DevOps-CrossAccountAccessRole/template.yml

@@ -92,21 +92,22 @@ Resources:
       PolicyDocument:
         Statement:
           - Action:
-              - acm:DescribeCertificate
               - acm:RequestCertificate
             Condition:
               StringEquals:
                 "aws:RequestTag/prx:lifetime": "temporary"
             Effect: Allow
             Resource: "*"
             Sid: AllowTempCertRequest
-          - Action: acm:DeleteCertificate
+          - Action:
+              - acm:DeleteCertificate
+              - acm:DescribeCertificate
             Condition:
               StringEquals:
                 "aws:ResourceTag/prx:lifetime": "temporary"
             Effect: Allow
             Resource: "*"
-            Sid: AllowTempCertDelete
+            Sid: AllowTempCertAccess
         Version: "2012-10-17"
 
   S3ListVersionsPolicy: