Repository: aws/serverless-application-model

Issue:
Format of Generated ARN for Policy Template `AMIDescribePolicy` Is Incorrect
<!-- Make sure we don't have an existing Issue that reports the bug you are seeing (both open and closed). 
If you do find an existing Issue, re-open or add a comment to that Issue instead of creating a new one. -->

### Description:
<!-- Briefly describe the bug you are facing.-->
When adding the SAM Policy Template `AMIDescribePolicy` to a Function, it is unable to describe images. The policy template uses as the input to `!Sub` the value `arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/*`. This is wrong in two ways:

1. AWS documentation claims that the format of an image's ARN is this: `arn:${Partition}:ec2:${Region}::image/${ImageId}`, without an account ID.
2. `ec2:DescribeImages` can't take a resource anyway; it has to be `*`.


### Steps to reproduce:
<!-- Provide detailed steps to replicate the bug, including steps from third party tools (CDK, etc.) -->
Create a Lambda Function which writes to an SSM parameter with data type `aws:ec2:image`. (Writing a valid AMI as the value, natch.) Provide this Function with permissions via the SAM Policy Template `AMIDescribePolicy`.

Upon execution, note that the client (boto3, say) confirms that the write succeeds. Watch CloudTrail for the parameter validation event. The event will indicate a failure with "Client.UnauthorizedOperation: You are not authorized to perform this operation."

Modify the Function to recreate `AMIDescribePolicy` manually:

```yaml
- Effect: Allow
  Action: ec2:DescribeImages
  Resource: '*'
```

Execute with the same input, note that the write succeeds, and note that the validation succeeds.

### Observed result:
<!-- Please provide command output with `--debug` flag set.-->
The validation fails and the parameter is rolled back to its previous version. (Or, I guess, the provisional new version never becomes current.)


### Expected result:
<!-- Describe what you expected.-->
The provisional new version becomes current. 


### Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: macOS Catalina 10.15.7
2. If using SAM CLI, `sam --version`: 1.19.1
3. AWS region: eu-west-1

`Add --debug flag to any SAM CLI commands you are running`


Discussion:
codecov-io: # [Codecov](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=h1) Report
> Merging [#1945](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=desc) (39aa04a) into [develop](https://codecov.io/gh/aws/serverless-application-model/commit/d1f234bfe044235f51768cffd2ce14aaaef383f3?el=desc) (d1f234b) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/aws/serverless-application-model/pull/1945/graphs/tree.svg?width=650&height=150&src=pr&token=9qv2cdbX38)](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=tree)

```diff
@@           Coverage Diff            @@
##           develop    #1945   +/-   ##
========================================
  Coverage    93.88%   93.88%           
========================================
  Files           90       90           
  Lines         5954     5954           
  Branches      1213     1213           
========================================
  Hits          5590     5590           
  Misses         168      168           
  Partials       196      196           
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=footer). Last update [d1f234b...39aa04a](https://codecov.io/gh/aws/serverless-application-model/pull/1945?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/samtranslator/policy_templates_data/policy_templates.json b/samtranslator/policy_templates_data/policy_templates.json
index a2d05c3b..b40b906f 100644
--- a/samtranslator/policy_templates_data/policy_templates.json
+++ b/samtranslator/policy_templates_data/policy_templates.json
@@ -478,9 +478,7 @@
             "Action": [
               "ec2:DescribeImages"
             ],
-            "Resource": {
-              "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/*"
-            }
+            "Resource": "*"
           }
         ]
       }


Test patch:
diff --git a/tests/translator/output/all_policy_templates.json b/tests/translator/output/all_policy_templates.json
index 7effbdef..4f8a344d 100644
--- a/tests/translator/output/all_policy_templates.json
+++ b/tests/translator/output/all_policy_templates.json
@@ -336,9 +336,7 @@
                   "Action": [
                     "ec2:DescribeImages"
                   ], 
-                  "Resource": {
-                    "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/*"
-                  }, 
+                  "Resource": "*", 
                   "Effect": "Allow"
                 }
               ]
diff --git a/tests/translator/output/aws-cn/all_policy_templates.json b/tests/translator/output/aws-cn/all_policy_templates.json
index 23149a3c..36634073 100644
--- a/tests/translator/output/aws-cn/all_policy_templates.json
+++ b/tests/translator/output/aws-cn/all_policy_templates.json
@@ -336,9 +336,7 @@
                   "Action": [
                     "ec2:DescribeImages"
                   ], 
-                  "Resource": {
-                    "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/*"
-                  }, 
+                  "Resource": "*", 
                   "Effect": "Allow"
                 }
               ]
diff --git a/tests/translator/output/aws-us-gov/all_policy_templates.json b/tests/translator/output/aws-us-gov/all_policy_templates.json
index f02a30ec..112dd4b9 100644
--- a/tests/translator/output/aws-us-gov/all_policy_templates.json
+++ b/tests/translator/output/aws-us-gov/all_policy_templates.json
@@ -336,9 +336,7 @@
                   "Action": [
                     "ec2:DescribeImages"
                   ], 
-                  "Resource": {
-                    "Fn::Sub": "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/*"
-                  }, 
+                  "Resource": "*", 
                   "Effect": "Allow"
                 }
               ]