fix: grant AWS SQLWorkspace RDS vendor permissions

[ciiiii]

Motivation

SQLWorkspace needs a PostgreSQL meta store per poolmember, but StreamNativeCloudBootstrapRole has no RDS write permissions, so rds:CreateDBSubnetGroup / rds:CreateDBInstance are denied by both the attached policy and the permission boundary.

Modifications

• Add rds:* to AllowedServices in the permission boundary, so the boundary defines the service-level ceiling only.
• Grant scoped RDS permissions in provision2.json.tpl, authorized by tag rather than resource name:
  • aws:RequestTag/Vendor = StreamNative on CreateDBInstance, CreateDBSubnetGroup and the AddTagsToResource authorization that RDS performs during creation.
  • aws:ResourceTag/Vendor = StreamNative on modify, delete and post-create tag operations.
  • PostgreSQL, private-access and encrypted-storage conditions preserved on CreateDBInstance.
  • An explicit Deny on removing the Vendor tag, since that would make the resource unmanageable.
• Keep Describe* and ListTagsForResource unscoped, where RDS does not support resource-level tag authorization.

Notes:

• rds:AddTagsToResource is required for creation to succeed: when tags are passed in a create call, RDS performs a second authorization against that action.
• og:default* / pg:default* are needed because CreateDBInstance authorizes against the default parameter and option groups it attaches.
• No snapshot, restore or delete-snapshot permissions. The meta store is disposable — automated backups are off and no snapshot is taken on delete.

Testing

• terraform validate and terraform fmt -check pass in modules/aws/vendor-access.
• Rendered policies parse as JSON; RDS statements are identical in the policy and the boundary.
• Applied to a test account and exercised end to end: instance create, update and delete all passed, and a workload pod connects to the instance over TLS.

[maxsxu]

I have two requested changes to keep the IAM model consistent and avoid coupling authorization to SQLWorkspace resource names:

1. In permission_boundary_iam_policy.json.tpl, please add rds:* to AllowedServices and remove the detailed SQLWorkspaceRDS* statements. The permission boundary should define the service-level ceiling; the scoped permissions belong in the attached provision policy. The boundary does not grant RDS access by itself—the effective permissions remain the intersection with the role's identity policies.

2. In provision2.json.tpl, please replace the *-snc resource-name restrictions with tag-based authorization:

   • Use aws:RequestTag/Vendor = StreamNative for CreateDBInstance, CreateDBSubnetGroup, and the required AddTagsToResource authorization during creation.
   • Preserve the PostgreSQL, private-access, and encrypted-storage conditions on CreateDBInstance.
   • Use aws:ResourceTag/Vendor = StreamNative for modify, delete, and post-create tag operations.
   • Keep Describe* and list operations unscoped where RDS does not support resource-level tag authorization.
   • Prevent removal of the Vendor ownership tag, since removing it would make the resource unmanageable through the tag-based policy.

This removes the load-bearing -snc naming convention while retaining ownership scoping. The current consumer uses skip_final_snapshot = true, so I suggest removing CreateDBSnapshot from this policy rather than retaining a name-scoped snapshot rule. If final snapshots are required, that path should be handled and tested separately because the target snapshot does not yet have a resource tag during authorization.

References:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_id-based-policy-examples-grant-permissions-tags-on-create.html