Rgjb te eli 422 add kms permissions to external role (#397)

* Added new kms policy for external write role

* Moved ref checkout to the top of deploy job

* Remove repeated code

* Appended firehouse kms permissions to external write role

Author: robbailiff2

infrastructure/stacks/api-layer/iam_policies.tf

@@ -515,7 +515,8 @@ data "aws_iam_policy_document" "external_role_s3_audit_kms_access_policy" {
       "kms:DescribeKey"
     ]
     resources = [
-      module.s3_audit_bucket.storage_bucket_kms_key_arn
+      module.s3_audit_bucket.storage_bucket_kms_key_arn,
+      module.eligibility_audit_firehose_delivery_stream.kinesis_firehose_cmk_arn
     ]
   }
 }