in provider/secret_descriptor.go [162:169]
func (p *SecretDescriptor) GetSecretType() (stype SecretType) {
// If no objectType, use ARN (but convert ssm to ssmparameter). Note that
// SSM does not actually allow ARNs but we convert anyway for other checks.
sType := p.getObjectType()
return typeMap[sType]
}