Expanding IAM support about provider-aws

[negz]

Following up on my most recent comment, I believe in rough order of priority we'll need:

1. Everything that is included in #141
2. A managed resource that represents an IAM policy.
3. A managed resource that represents an IAM user.
4. A managed resource that represents the attachment of an IAM policy to an IAM user.

I believe this will enable our current use cases, the ability to grant a user access to an S3 bucket, and the ability to grant a pod (role) access to an RDS instance per #126 (comment). Once those three resources are added I think we can safely pause work on IAM until the community comes forward with additional use cases for IAM.

[sahil-lakhwani]

4. A managed resource that represents the attachment of an IAM policy to an IAM user.

@negz Should this have a managed policy (arn) or an inline policy (JSON document) or both?

[negz]

My suspicion is that we might be able to deprioritise IAM once #141 is merged. We started with IAM mostly because it was (in theory) a simple service, rather than because it was super high priority. My suspicion is that now we have IAM roles, policles, and attachments modelled we've probably got most of the IAM use cases covered.

IAMUser may be the one additional thing we need; I believe S3 buckets frequently make use of them.

[prasek]

completed via:

• #141
• #194
• #196
• #249