ci: add GHA for publishing CF templates to S3

[InesNi]

Description

Creating a GHA for publishing 2 CloudFormation templates to S3. The templates are for creating IAM resources users need to run Lambda / Fargate tests.

Once the templates are hosted on S3, CloudFormation quick-create links can be created and added to the docs in button format, simplifying the set up process for users.

The templates will create an an ArtilleryDistributedTestingFargateRole/ ArtilleryDistributedTestingLambdaRole with the ArtilleryDistributedTestingFargatePolicy/ ArtilleryDistributedTestingLambdaPolicy respectively.

The policies used are the original ones from the docs, though the Lambda one needed a few fixes to function properly:

• The Resource in the CreateLambdaPolicy was missing -*

• The EcrPullImagePermissions needed to be changed so that instead of setting a Condition we set the Resource to the arn of the repository of the exact account we are pulling from

Testing

Manually tested both Cloudformation templates making sure that all the necessary resources are created, and tested e2e by running the Fargate and Lambda tests.

Tested that the GHA appropriately updates the templates on S3.

Notes

• Currently a test bucket is used, waiting to see if a different bucket will be used to host the templates.

Pre-merge checklist

• Does this require an update to the docs?
• Does this require a changelog entry? Not sure

[InesNi]

The policy used here is the original one from the docs, the only difference is the account id being set dynamically.

The role is currently set to be able to be assumed by anyone/anything and should be appropriately restricted by user.

[InesNi]

The policy used here is the original one from the docs with some changes, as it had a few mistakes that needed to be adjusted as seen in comments below.

The role is currently set to be able to be assumed by anyone/anything and should be appropriately restricted by user.

[InesNi]

In the original policy from the docs Resource here was missing -* at the end.

[InesNi]

The EcrPullImagePermissions needed to be changed so that instead of setting a Condition we set the Resource to the arn of the repository of the exact account we are pulling from.

The initial policy from the docs was using:

{
  "Sid": "EcrPullImagePermissions",
  "Effect": "Allow",
  "Action": [
                    "ecr:GetDownloadUrlForLayer",
                    "ecr:BatchGetImage"
                  ],
  "Resource": "*",
  "Condition": {
     "StringLike": {
          "aws:sourceArn": "arn:aws:lambda:*:123456789000:function:artilleryio-*"
        }
  }
}