aws ec2 integration: allow users to set up integration using AssumeRole

[vjeffrey]

User Story

As an Automate user, I want to be able to scan all my AWS accounts from Automate by using the AssumeRole functionality per scannable account.

From our friends at AWS:

Let's say your Automate server is running in Account 1111 and you want to scan APIs and EC2 instances in Account 2222. You set up a role that lets you access the resources of your account (e.g. giving permissions for ReadOnly access and SSM for credential-less scanning. That role also gets a Trust Relationship towards account 2222.
Now on Chef Automate in Account 1111 you assume the role from Account 2222 and execute your calls with permissions of the role you assumed on the resources in 2222.

Considerations

the first step to this will be discovery work on the backend side for what needs to be done to make this happen
as a second step, we should communicate that to ux (@jonong1972) so that he can design something for the ui to accommodate the change
then we can complete the backend work and create the ui

Definition of Done

Can add an aws-ec2 integration using the AssumeRole functionality

[vjeffrey]

I took a look at the code this evening; it looks like we may already support this. There's an (untested) code path for using a role arn to authenticate with the aws api.
I will try to find someone to help me test this functionality tomorrow.
As it stands, it seems that doing the following api call would work..

 example of adding a nodemanager
 curl -s --insecure -H "api-token: $token" $url/api/v0/nodemanagers -d '{
     "name": "my aws api integration with role arn",
     "type": "aws-api",
     "instance_credentials": [],
      "credential_data": [
 		{"key": "ARN_ROLE", "value": "value" }
 	]
   }'

[vjeffrey]

i tested this morning but got a 403 from the aws api.
I'll have to take a deeper look (the way i set up the role may have been incorrect) next week.

what i did to setup the role:
logged into one account
created iam role with trusted relationship to another account.
ensured the correct permissions (policy) was attached to that role.

error:
2019-07-19 17:22:58.642702604 +0000 UTC:GetAccountID unable to call GetCallerIdentity API: AccessDenied: Access denied\n\tstatus code: 403, request id: da74259b-aa49-11e9-82de-f3e0fce6796c

[vjeffrey]

https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/stscreds/