feat: Disable Execution Role Permission Addition for DD API Key Secret

[gabedos]

What does this PR do?

Introduces dd_manage_execution_role_secret_permissions that controls whether to create and attach secret access permissions to the execution role.

Set to false if your execution role already has the necessary secretsmanager:GetSecretValue permissions.

Motivation

#47

Describe how you validated your changes

This change does not support unit tests with the current framework because it involves IAM roles. Current unit tests only check for the configuration of the datadog agent task definition itself.

Manual QA steps:

1. Define a dummy dd_api_key_secret value.
2. Disable execution role editing via dd_manage_execution_role_secret_permissions = false
3. terraform apply
4. Open the task definitions's respective IAM role and observe that the dd-secret-access policy was not attached.

[clamoriniere]

Instead of using a bool for the new parameter, have you considered to ask the user to provide the role name so it can be possible to verify that it exists.

[gabedos]

The user will already be supplying the role name via the variable execution_role. If the role exists and a secret api key is provided, we don't know if has the proper permissions configured and the module currently always adds the policy to get the secret.

• If the role doesn't actually exist (dummy or incorrect value) then I believe the AWS API will reject the task creation request.
• If no role is provided, then AWS API will also reject the request because it knows secrets are being loaded in which requires some execution role to be configured.