fix: grant AWS SQLWorkspace RDS vendor permissions

[ciiiii]

Motivation

SQLWorkspace needs a PostgreSQL meta store per poolmember, but StreamNativeCloudBootstrapRole has no RDS write permissions, so rds:CreateDBSubnetGroup / rds:CreateDBInstance are denied by both the attached policy and the permission boundary.

Modifications

• Grant scoped RDS permissions for *-snc resources in provision2.json.tpl: create instance and subnet group (postgres, private, encrypted, Vendor=StreamNative), manage/delete, tag, and final snapshot.
• Add the same statements to the permission boundary, since effective permission is the intersection of the two.
• Allow rds:Describe* and rds:ListTagsForResource in the existing read-only statement.
• Document RDS as a bootstrap-role capability.
• Apply terraform fmt (whitespace only).

Notes:

• Scoping is by resource name, not tag: RDS cannot authorize a create on tags, so rds:AddTagsToResource is granted separately and is required for create to succeed.
• og:default* / pg:default* are needed because CreateDBInstance authorizes against the default parameter and option groups it attaches.
• No restore or delete snapshot permission is granted.

Testing

• terraform validate and terraform fmt -check pass in modules/aws/vendor-access.
• Applied to a test account: RDS instance create, update and delete all passed.

[maxsxu]

I have two requested changes to keep the IAM model consistent and avoid coupling authorization to SQLWorkspace resource names:

1. In permission_boundary_iam_policy.json.tpl, please add rds:* to AllowedServices and remove the detailed SQLWorkspaceRDS* statements. The permission boundary should define the service-level ceiling; the scoped permissions belong in the attached provision policy. The boundary does not grant RDS access by itself—the effective permissions remain the intersection with the role's identity policies.

2. In provision2.json.tpl, please replace the *-snc resource-name restrictions with tag-based authorization:

   • Use aws:RequestTag/Vendor = StreamNative for CreateDBInstance, CreateDBSubnetGroup, and the required AddTagsToResource authorization during creation.
   • Preserve the PostgreSQL, private-access, and encrypted-storage conditions on CreateDBInstance.
   • Use aws:ResourceTag/Vendor = StreamNative for modify, delete, and post-create tag operations.
   • Keep Describe* and list operations unscoped where RDS does not support resource-level tag authorization.
   • Prevent removal of the Vendor ownership tag, since removing it would make the resource unmanageable through the tag-based policy.

This removes the load-bearing -snc naming convention while retaining ownership scoping. The current consumer uses skip_final_snapshot = true, so I suggest removing CreateDBSnapshot from this policy rather than retaining a name-scoped snapshot rule. If final snapshots are required, that path should be handled and tested separately because the target snapshot does not yet have a resource tag during authorization.

References:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_id-based-policy-examples-grant-permissions-tags-on-create.html