Fix(extra7141): Error handling and include missing policy (#1024)

* Fix AccessDenied issue when get document

Add check to validate access denied when get document from SSM.
Add missing action permission to allow ssm:GetDocument.

* Double quote variables to prevent globbing and word splitting

util/codebuild/codebuild-prowler-audit-account-cfn.yaml

@@ -141,7 +141,7 @@ Resources:
           - id: W28
             reason: "Explicit name is required for this resource to avoid circular dependencies."
     Properties:
-      RoleName: !Sub 'prowler-codebuild-role'
+      RoleName: 'prowler-codebuild-role'
       Path: '/service-role/'
       ManagedPolicyArns:
         - 'arn:aws:iam::aws:policy/job-function/SupportUser'
@@ -187,16 +187,17 @@ Resources:
                   - ds:ListAuthorizedApplications
                   - ec2:GetEbsEncryptionByDefault
                   - ecr:Describe*
-                  - support:Describe*
-                  - tag:GetTagKeys
-                  - lambda:GetFunction
+                  - elasticfilesystem:DescribeBackupPolicy
                   - glue:GetConnections
                   - glue:GetSecurityConfiguration
                   - glue:SearchTables
+                  - lambda:GetFunction
                   - s3:GetAccountPublicAccessBlock
-                  - shield:GetSubscriptionState
                   - shield:DescribeProtection
-                  - elasticfilesystem:DescribeBackupPolicy
+                  - shield:GetSubscriptionState
+                  - ssm:GetDocument
+                  - support:Describe*
+                  - tag:GetTagKeys
                 Effect: Allow
                 Resource: '*'
         - PolicyName: CodeBuild