Manage the IAM roles of compliance people

[pburkholder]

In order to logically manage the IAM roles of compliance folks we should specify them in TF

Acceptance Criteria

• [ ]

---

Security considerations

Yes. This will need careful review
[note any potential changes to security boundaries, practices, documentation, risk that arise directly from this story]

Implementation sketch

• Create a Compliance group
• Compliance group should have the following roles
  • AWS managed policy: SupportUser
  • AWS managed policy: SecurityAudit
  • custom policy: ManageMFAandAccessKeys
  • custom policy: AdditionalCGSecurity

The AdditionalCGSecurity policy should include:

• e.g.: https://github.com/awsdocs/amazon-cloudwatch-user-guide/blob/master/doc_source/iam-identity-based-access-control-cw.md

        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "logs:Get*",
        "logs:Describe*",
        "sns:Get*",
        "sns:List*"
      ],
      "Effect": "Allow",
      "Resource": "*

• Add compliance people to that group
• Remove extraneous policies no longer in use

[pburkholder]

Started this because I can't view Cloudwatch Logs. Can be completed down the line.