ssm.json

"SSMCredentialPolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "Roles": [
                    {
                        "Ref": "FetcherTaskRole"
                    }
                ],
                "Users": [
                    {
                        "Ref": "BackendFetcherTestUser"
                    }
                ],
                "PolicyName": "GetSteamCredentialsFromSSM",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "ssm:GetParameter*"
                            ],
                            "Resource": [
                                {
                                    "Fn::Sub": "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/steam/username"
                                },
                                {
                                    "Fn::Sub": "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/steam/password"
                                },
                                {
                                    "Fn::Sub": "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/steam/depot/*"
                                }
                            ]
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "ssm:PutParameter"
                            ],
                            "Resource": [
                                {
                                    "Fn::Sub": "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/steam/depot/*"
                                }
                            ]
                        }
                    ]
                }
            }
        }