AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity about secrets-store-csi-driver-provider-aws

[vito-laurenza-zocdoc]

We found the root cause of the issue, which was two-fold.

1. We hit this scenario with eksctl, which was confusing at best.
2. The objectNames in my SecretProviderClass resource were missing the leading slash for ssm param names. (I thought I read that the leading slash should be left off, but I can't find where I saw that now). The correct format should be:

---
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: vitotest-aws-secrets
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "/vitotest/mykey"
        objectType: "ssmparameter"
      - objectName: "/vitotest/mysecret"
        objectType: "ssmparameter"