Fixed potential self-escalation from iam:PassRole

[comrumino]

What I did

• Moved iam:PassRole from AllowOperations to a new statement named AllowPassRole and limited the resources/roles that can be passed to aws_iam_role.ec2 and aws_iam_role.service

Why I did it

• The current default policy document is overly permissive and was reported by our security tooling as a having the potential for privilege escalation. Without restricting which roles can be passed, a role with elevated privileges could be passed.
• Splitting actions into smaller statements make overriding resources or specific statements less unwieldy.

[aknysh]

/test all