Separate iam into root-iam and iam

what

• Separate iam into root-iam and iam

why

• Simpler cold start process
• Don't have to use -target with terraform apply

notes

• this is for Igor Rodionov (@goruha) to provision new accounts
• we'll restructure it again after we introduce subfolders (e.g. root/aim, root/dns)
• that restructuring will require re-applying the existing accounts or copying Terraform states into the new S3 folders