# module.eks_blueprints_kubernetes_addons.module.external_secrets[0].aws_iam_policy.external_secrets will be updated in-place
  ~ resource "aws_iam_policy" "external_secrets" {
        id          = "arn:aws:iam::<account>:policy/eks-external-secrets-irsa"
        name        = "eks-external-secrets-irsa"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = "arn:aws:ssm:*:*:parameter/*" -> [
                          + "arn:aws:ssm:eu-central-1:<account>:parameter/*",
                          + "arn:aws:ssm:*:*:parameter/*",
                        ]
                        # (3 unchanged elements hidden)
                    },
                  ~ {
                      ~ Resource = "arn:aws:secretsmanager:*:*:secret:*" -> [
                          + "arn:aws:secretsmanager:eu-central-1:<account>:secret:*",
                          + "arn:aws:secretsmanager:*:*:secret:*",
                        ]
                        # (3 unchanged elements hidden)
                    },
                  + {
                      + Action   = "ssm:DescribeParameters"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:eu-central-1:<account>:*"
                      + Sid      = ""
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }