ecs_cluster test suite refactor (ansible#57716)

* Combine testing policies

Because of the maximum of 10 policies per group, need to
consolidate testing policies as best we can.

* Tidy put-account-setting tasks and add permission

Using `environment` and `command` rather than `shell` avoids the
need for `no_log` and means that people can fix the problem

* refactor ecs_cluster test suite

move from runme.sh technique to virtualenv

use ec2_instance rather than ec2 module to
avoid need for boto

hacking/aws_config/testing_policies/container-policy.json

@@ -39,6 +39,7 @@
             "ecs:DeregisterTaskDefinition",
             "ecs:Describe*",
             "ecs:List*",
+            "ecs:PutAccountSetting",
             "ecs:RegisterTaskDefinition",
             "ecs:RunTask",
             "ecs:StartTask",

hacking/aws_config/testing_policies/database-policy.json

@@ -63,6 +63,21 @@
             "Resource": [
                 "arn:aws:rds:{{aws_region}}:{{aws_account}}:pg:*"
             ]
+        },
+        {
+          "Sid": "AllowRedshiftManagment",
+          "Action": [
+              "redshift:CreateCluster",
+              "redshift:CreateTags",
+              "redshift:DeleteCluster",
+              "redshift:DeleteTags",
+              "redshift:DescribeClusters",
+              "redshift:DescribeTags",
+              "redshift:ModifyCluster",
+              "redshift:RebootCluster"
+          ],
+          "Effect": "Allow",
+          "Resource": "*"
         }
     ]
 }

hacking/aws_config/testing_policies/security-policy.json

@@ -63,7 +63,6 @@
             "Effect": "Allow",
             "Sid": "AllowReplacementOfSpecificInstanceProfiles"
         },
-
         {
             "Sid": "AllowWAFusage",
             "Action": "waf:*",
@@ -93,10 +92,66 @@
             ]
         },
         {
-            "Sid": "AllowWAFRegionalusage",
-            "Action": "waf-regional:*",
+            "Sid": "AllowSTSAnsibleTests",
+            "Action": [
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "iam:DetachRolePolicy",
+                "sts:AssumeRole",
+                "iam:AttachRolePolicy",
+                "iam:CreateInstanceProfile"
+            ],
             "Effect": "Allow",
+            "Resource": [
+                "arn:aws:iam::{{aws_account}}:role/ansible-test-sts-*",
+                "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-sts-*"
+            ]
+        },
+        {
+            "Sid": "AllowAccessToUnspecifiedKMSResources",
+            "Effect": "Allow",
+            "Action": [
+                "kms:CancelKeyDeletion",
+                "kms:CreateAlias",
+                "kms:CreateGrant",
+                "kms:CreateKey",
+                "kms:DeleteAlias",
+                "kms:Describe*",
+                "kms:DisableKey",
+                "kms:EnableKey",
+                "kms:GenerateRandom",
+                "kms:Get*",
+                "kms:List*",
+                "kms:RetireGrant",
+                "kms:ScheduleKeyDeletion",
+                "kms:TagResource",
+                "kms:UntagResource",
+                "kms:UpdateGrant",
+                "kms:UpdateKeyDescription"
+            ],
             "Resource": "*"
+        },
+        {
+            "Sid": "AllowAccessToSpecifiedIAMResources",
+            "Effect": "Allow",
+            "Action": [
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "iam:GetRole",
+                "iam:PassRole",
+                "iam:UpdateAssumeRolePolicy"
+            ],
+            "Resource": "arn:aws:iam::{{aws_account}}:role/ansible-test-*"
+        },
+        {
+            "Sid": "AllowInstanceProfileCreation",
+            "Effect": "Allow",
+            "Action": [
+                "iam:AddRoleToInstanceProfile",
+                "iam:CreateInstanceProfile",
+                "iam:RemoveRoleFromInstanceProfile"
+            ],
+            "Resource": "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-*"
         }
     ]
 }

hacking/aws_config/testing_policies/storage-policy.json

@@ -37,6 +37,14 @@
             ],
             "Effect": "Allow",
             "Resource": "*"
+        },
+        {
+            "Sid": "ManageEFS",
+            "Effect": "Allow",
+            "Action": [
+                "elasticfilesystem:*"
+            ],
+            "Resource": "*"
         }
     ]
 }

test/integration/targets/ecs_cluster/meta/main.yml

@@ -0,0 +1,2 @@
+dependencies:
+  - setup_remote_tmp_dir