Grant Terraform Cloud role access to Access Analyzer

This is required for TFC to manage Access Analyzer resources

Author: samsimpson1

terraform/deployments/tfc-aws-config/aws_oidc.tf

@@ -38,6 +38,7 @@ data "aws_iam_policy_document" "tfc_policy" {
   statement {
     resources = ["*"]
     actions = [
+      "access-analyzer:*",
       "acm:*",
       "apigateway:*",
       "athena:*",
@@ -130,6 +131,11 @@ data "aws_iam_policy_document" "tfc_policy" {
       "arn:aws:iam::*:user/govuk-*-fastly-logs-athena-monitoring"
     ]
   }
+  statement {
+    effect    = "Allow"
+    actions   = ["iam:CreateServiceLinkedRole"]
+    resources = ["arn:aws:iam::*:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"]
+  }
   statement {
     effect    = "Deny"
     resources = ["*"]
@@ -145,7 +151,6 @@ data "aws_iam_policy_document" "tfc_policy" {
       "iam:*Login*",
       "iam:*Group*",
       "iam:*PermissionsBoundary*",
-      "iam:CreateServiceLinkedRole",
     ]
   }
 }