Override IAM policy attachment created

[lachlanmulcahy]

Describe the Feature

Ability to define the IAM policy attachment used.

Note: Assuming we move from inline to attachments.

Expected Behavior

When an IAM Policy attachment is specified, it is used in place of the one that would be created by default.

Use Case

We would like to control more closely the IAM policy to restrict access to different secrets. The default policy allows the host to effectively read any secret in the entire account, as I interpret it.

Describe Ideal Solution

New input: iam_policy_attachment -- takes some identifier of a resource for the policy attachment created by the user.
If set, this policy is used in place of the default created. If not, one is created by default.

Alternatives Considered

None.

Additional Context

The permissiveness of the default policy seems like a pretty big security risk for a bastion host module that users who may lack experience are going to utilize and may rollout unknowingly.