Repository: aws-cloudformation/cfn-lint

Issue:
Incorrect KMS resource validation when using shorthand SSM parameters
### CloudFormation Lint Version

1.38.0

### What operating system are you using?

Linux

### Describe the bug

```
[cfn-lint] I3510: action 'kms:Encrypt' requires a resource of ['arn:${Partition}:kms:${Region}:${Account}:key/.*']

[cfn-lint] I3510: action 'kms:Decrypt' requires a resource of ['arn:${Partition}:kms:${Region}:${Account}:key/.*']

[cfn-lint] I3510: action 'kms:GenerateDataKey' requires a resource of ['arn:${Partition}:kms:${Region}:${Account}:key/.*']
```

### Expected behavior

Preferably cfn-lint supports something along the lines of a parameter substitution json/yml file that we can set a value but in lieu of that, consistent behaviour between short-hand and parameter resolution.

### Reproduction template

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: 'demo template'

Parameters:
  kmsKeyArn:
    Type: 'AWS::SSM::Parameter::Value<String>'
    Description: 'SSM Parameter Name containing kms key ARN. Default: /My/resources/kms_key_arn'
    Default: /My/resources/kms_key_arn

Resources:
  iAMPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: 'DemoPolicy'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: !Ref kmsKeyArn

  iAMPolicy2:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: 'DemoPolicy'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "{{resolve:ssm:/My/resources/kms_key_arn}}"
```


Discussion:

Patch:
diff --git a/src/cfnlint/rules/resources/iam/StatementResources.py b/src/cfnlint/rules/resources/iam/StatementResources.py
index a278717b38..9dafbfa3c9 100644
--- a/src/cfnlint/rules/resources/iam/StatementResources.py
+++ b/src/cfnlint/rules/resources/iam/StatementResources.py
@@ -9,8 +9,10 @@
 from collections import deque
 from typing import Any
 
+import regex as re
+
 from cfnlint.data import AdditionalSpecs
-from cfnlint.helpers import ensure_list, is_function, load_resource
+from cfnlint.helpers import REGEX_DYN_REF, ensure_list, is_function, load_resource
 from cfnlint.jsonschema import ValidationError, ValidationResult, Validator
 from cfnlint.rules.helpers import get_value_from_path
 from cfnlint.rules.jsonschema.CfnLintKeyword import CfnLintKeyword
@@ -105,7 +107,10 @@ def validate(
                 resources = ensure_list(resources)
 
                 for resource in resources:
-                    if not isinstance(resource, str):
+                    if isinstance(resource, str):
+                        if re.match(REGEX_DYN_REF, resource):
+                            return
+                    else:
                         k, v = is_function(resource)
                         if k is None:
                             continue


Test patch:
diff --git a/test/unit/rules/resources/iam/test_statement_resources.py b/test/unit/rules/resources/iam/test_statement_resources.py
index d17f04bd66..24e12be402 100644
--- a/test/unit/rules/resources/iam/test_statement_resources.py
+++ b/test/unit/rules/resources/iam/test_statement_resources.py
@@ -187,6 +187,13 @@ def template():
                 # ),
             ],
         ),
+        (
+            {
+                "Action": ["kms:Encrypt"],
+                "Resource": ["{{resolve:ssm:/My/resources/kms_key_arn}}"],
+            },
+            [],
+        ),
         (
             {
                 "Action": ["cloudformation:CreateStackSet"],