allow juju add-unit to inherit IAM policies from AWS

[Adam Stokes]

Currently, conjure-up can set IAM policies on everything it initially deploys. However, anyone wanting to do add-unit's will not inherit those policies and ultimately fail to do things such as join existing kubernetes cluster that have CNI enabled.

I'm not sure if this is something we could utilize in the model config and have juju check for IAM policies if provider == ec2 or what the best approach is.

Some reference https://github.com/conjure-up/spells/issues/102

[Cory Johns (johnsca)]

Specifically, we need something akin to the resource-tags model config but for IAM roles.

[Cory Johns (johnsca)]

OTOH, there was discussion in Warsaw about properly modeling native integration in Juju by providing a way that a charm could request a short-term token to perform cloud operations directly rather than depending on something external, such as conjure-up, to do those operations. That would make this moot and enable us to move the cloud-specific behavior into something like an AWS ELB proxy charm.

[Canonical Juju QA Bot (juju-qa-bot)]

This Medium-priority bug has not been updated in 60 days, so we're marking it Low importance. If you believe this is incorrect, please update the importance.