feat: Explicit self-assume permission for IAM assumable role with OIDC

[miklapko]

Description

Adds the ability to implement self-assume permission for IAM assumable role with OIDC.

Motivation and Context

AWS is changing the way IAM role trust policies work. Before, they implicitly allowed the role to assume itself. After the change, an explicit permission is needed.

Breaking Changes

No.

How Has This Been Tested?

Tested via Terraform Enterprise on multiple environments, with prior config (without the new variable input) and with explicit_permission_to_assume_self = true.

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects
• I have executed pre-commit run -a on my pull request

[antonbabenko]

Looks pretty good. Minor comments. Thanks for the quick addition.

[FernandoMiguel]

this is great work.
can this be mirrored for the https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/modules/iam-role-for-service-accounts-eks module too ?

[bryantbiggs]

instead of a new document data source and then merging documents, we can use a dynamic statement block instead like

  dynamic "statement" {
    for_each = var.explicit_permission_to_assume_self ? [1] : []
    
    content {
      ...
    }
  }

[bryantbiggs]

this is great work. can this be mirrored for the master/modules/iam-role-for-service-accounts-eks module too ?

yes - @miklapko can we add this to all roles that are supported in this project please

[FernandoMiguel]

thanks folks.
this is currently blocking us, from using argocd.
we have an aws support ticket open and our TAM is involved too. they were the ones linking this PR to us.

[antonbabenko]

This issue has been resolved in version 5.5.0 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.