feat: allow policy customization

[leonsteinhaeuser]

Description

This PR refactors the AWS IAM role and policy management for dynamic credential authentication between AWS and Terraform Cloud. The goal of this PR was to support dedicated workspace assignment. This was not possible in the previous implementation.

How Has This Been Tested?

I started a local plan with my temporary credentials for our AWS management account.

Plan Output

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.tfc_aws_dynamic_credentials.tfe_project_variable_set.tfc_project will be created
  + resource "tfe_project_variable_set" "tfc_project" {
      + id              = (known after apply)
      + project_id      = "prj-<something>"
      + variable_set_id = (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.tfe_variable.tfe_aws_provider_auth will be created
  + resource "tfe_variable" "tfe_aws_provider_auth" {
      + category        = "env"
      + description     = "AWS provider auth"
      + hcl             = false
      + id              = (known after apply)
      + key             = "TFC_AWS_PROVIDER_AUTH"
      + readable_value  = "true"
      + sensitive       = false
      + value           = (sensitive value)
      + variable_set_id = (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.tfe_variable.tfe_aws_provider_auth_arn will be created
  + resource "tfe_variable" "tfe_aws_provider_auth_arn" {
      + category        = "env"
      + description     = "AWS provider auth"
      + hcl             = false
      + id              = (known after apply)
      + key             = "TFC_AWS_RUN_ROLE_ARN"
      + readable_value  = (known after apply)
      + sensitive       = false
      + value           = (sensitive value)
      + variable_set_id = (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.tfe_variable_set.tfc_aws_dynamic_credentials will be created
  + resource "tfe_variable_set" "tfc_aws_dynamic_credentials" {
      + description   = "AWS dynamic credentials"
      + global        = false
      + id            = (known after apply)
      + name          = "aws-dynamic-credentials-management"
      + organization  = "Tagesspiegel"
      + priority      = false
      + workspace_ids = (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.module.aws_identity_provider.aws_iam_openid_connect_provider.this will be created
  + resource "aws_iam_openid_connect_provider" "this" {
      + arn             = (known after apply)
      + client_id_list  = [
          + "app.terraform.io",
        ]
      + id              = (known after apply)
      + tags_all        = (known after apply)
      + thumbprint_list = [
          + "<thumbprint>",
        ]
      + url             = "https://app.terraform.io"
    }

  # module.tfc_aws_dynamic_credentials.module.aws_tfc_dynamic_credentials_iam_roles.aws_iam_policy.this will be created
  + resource "aws_iam_policy" "this" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Grants terraform cloud access to AWS (generated by terraform). This policy is attached to the role created by terraform. Do not modify this policy manually. If you need to modify the permissions, modify the terraform code and re-run terraform."
      + id               = (known after apply)
      + name             = "terraform-cloud-dynamic-credentials"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "ec2:*",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                  + {
                      + Action   = [
                          + "iam:*",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                  + {
                      + Action   = [
                          + "s3:*",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags_all         = (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.module.aws_tfc_dynamic_credentials_iam_roles.aws_iam_role.this will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "terraform-cloud-dynamic-credentials"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.tfc_aws_dynamic_credentials.module.aws_tfc_dynamic_credentials_iam_roles.aws_iam_role_policy_attachment.this will be created
  + resource "aws_iam_role_policy_attachment" "this" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "terraform-cloud-dynamic-credentials"
    }

Plan: 8 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + aws_tfc_audience = (sensitive value)
  + full_name        = "terraform-cloud-dynamic-credentials"
  + oidc_claims      = (known after apply)
  + role_arns        = (known after apply)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings