[QT-444] Use repo isolated AWS account for enos CI tests (#2727)

* [QT-444] Use repo isolated AWS account for enos CI tests

enos/README.md

@@ -158,7 +158,7 @@ Here are the steps to configure the GitHub Actions service user:
 2. **Execute the Terraform module**
 ```shell
 > cd ./enos/ci/service-user-iam
-> export TF_WORKSPACE=<repo name>-ci-service-user-iam
+> export TF_WORKSPACE=<repo name>-ci-enos-service-user-iam
 > export TF_TOKEN_app_terraform_io=<Terraform Cloud Token>
 > export TF_VAR_repository=<repository name>
 > terraform init

enos/ci/service-user-iam/main.tf

@@ -18,10 +18,16 @@ terraform {
 locals {
   enterprise_repositories = ["boundary-enterprise", "boundary-hcp"]
   is_ent                  = contains(local.enterprise_repositories, var.repository)
-  service_user            = "github_actions-boundary_ci"
+  service_user            = data.aws_iam_user.service_user.user_name
   oss_aws_account_id      = "271311691044"
 }
 
+
+data "aws_iam_user" "service_user" {
+  # This is the user created in the hashicorp/hc-service-users repo
+  user_name = "github_actions-boundary_ci"
+}
+
 resource "aws_iam_role" "role" {
   count = local.is_ent ? 0 : 1 // only create a role for the OSS repositories
 
@@ -158,6 +164,7 @@ data "aws_iam_policy_document" "enos_policy_document" {
       "iam:CreatePolicy",
       "iam:CreateRole",
       "iam:CreateRole",
+      "iam:CreateServiceLinkedRole",
       "iam:CreateUser",
       "iam:CreateUserPolicy",
       "iam:CreateUserTag",

enos/modules/iam_setup/main.tf

@@ -12,9 +12,10 @@ locals {
 }
 
 resource "aws_iam_user" "boundary" {
-  name                 = "boundary-e2e-${var.test_id}"
-  tags                 = { boundary-demo = local.user_email }
-  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/BoundaryDemoPermissionsBoundary"
+  name = "boundary-e2e-${var.test_id}"
+  # These are disabled currently, as we cannot lock down this user and still perform certain tests with the service user
+  #  tags                 = { boundary-demo = local.user_email }
+  #  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/BoundaryDemoPermissionsBoundary"
 }
 
 resource "aws_iam_user_policy" "boundary" {