Manually create service linked roles

[cat5inthecradle]

This unblocks #43755 for INF-506

These roles would normally be created automatically the first time you create a Lambda@Edge implementation, but rather than giving CloudFormationService the permissions necessary to create them, we will create them explicitly here.

Lambda@Edge Permissions: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html

More: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html

Service Linked Roles for Lambda@Edge: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html#using-service-linked-roles

Rather than using the CLI to create them, we're using cloudformation.

Links

• jira ticket: INF-506

Testing story

$ export AWS_PROFILE=codeorg-admin
$ bin/aws_access
$ bundle exec rake stack:iam:validate RAILS_ENV=production ADMIN=1

Pending update for stack `IAM`:
Add CloudfrontLoggerRole [AWS::IAM::ServiceLinkedRole]
Add LambdaReplicatorRole [AWS::IAM::ServiceLinkedRole]

Deployment strategy

$ export AWS_PROFILE=codeorg-admin
$ bin/aws_access
AWS access: GoogleSignInAdmin/suresh@code.org
$ bundle exec rake stack:iam:start RAILS_ENV=production ADMIN=1

Stack update requested, waiting for provisioning to complete...
2021-11-29 21:42:08 UTC- IAM [UPDATE_IN_PROGRESS]: User Initiated
.2021-11-29 21:42:15 UTC- CloudfrontLoggerRole [CREATE_IN_PROGRESS]
.2021-11-29 21:42:15 UTC- LambdaReplicatorRole [CREATE_IN_PROGRESS]
2021-11-29 21:42:17 UTC- LambdaReplicatorRole [CREATE_IN_PROGRESS]: Resource creation Initiated
2021-11-29 21:42:18 UTC- LambdaReplicatorRole [CREATE_COMPLETE]
2021-11-29 21:42:18 UTC- CloudfrontLoggerRole [CREATE_IN_PROGRESS]: Resource creation Initiated
2021-11-29 21:42:18 UTC- CloudfrontLoggerRole [CREATE_COMPLETE]
.2021-11-29 21:42:21 UTC- IAM [UPDATE_COMPLETE_CLEANUP_IN_PROGRESS]

Stack update complete.

Follow-up work

Privacy

Security

Caching

PR Checklist:

• Tests provide adequate coverage
• Privacy and Security impacts have been assessed
• Code is well-commented
• New features are translatable or updates will not break translations
• Relevant documentation has been added or updated
• User impact is well-understood and desirable
• Pull Request is labeled appropriately
• Follow-up work items (including potential tech debt) are tracked and linked