DOM-54018 Allow GCP access to flyte-dataplane IAM

[ddl-ebrown]

• Allow GCP tokens with a custom audience matching the string
  {deploy_id}-flyte-gcp-{random_id} to access Flyte blobs

  Inspired by policy definition at
  https://jason-umiker.medium.com/cross-cloud-identities-between-gcp-and-aws-from-gke-and-or-eks-182652bddadb

  NOTE: jwt validation usually takes into account several factors

  • issuer
  • audience
  • signature
  • subject
  • scope
  • custom claims

  This policy verifies only the "aud" claim in the token, which in
  theory is spoofable by anyone using GCP to produce tokens. Therefore,
  include a random piece of data in the "aud" value that only the
  control plane will know. When generating executions on remote data
  planes (by dispatcher / workload operator), this value will be passed
  so that tokens produced from GCP will have this shared value.

  To do so requires exporting the value from the terraform code into
  the catalog and through to Nucleus

[ddl-ebrown]

Azure will look something like this

{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/sts.windows.net/<AZURE_AD_TENANT_ID>/"
          },
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Condition": {
            "StringEquals": {
              "sts.windows.net/<AZURE_AD_TENANT_ID>/:aud": "<AZURE_AD_APPLICATION_ID>"
            }
          }
        }
      ]
    }

OR

{
    "Version": 2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Federated": "arn:aws:iam::<AWS Account ID>:oidc-provider/sts.windows.net/<Microsoft Entra Tenant ID>/"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
            "StringEquals": {
                "sts.windows.net/<Microsoft Entra Tenant ID>/:aud": "<Application ID URI>",
                "sts.windows.net/<Microsoft Entra Tenant ID>/:sub": "<Managed Identity’s Object (Principal)ID>"
            }
        }
    }]
}

More details in https://aws.amazon.com/blogs/security/how-to-access-aws-resources-from-microsoft-entra-id-tenants-using-aws-security-token-service/

[ddl-ebrown]

Opened up a separate PR at #412 for that since it will generally be a pain

[Secretions]

Fixing tf-lint had an effect on the docs again. :( General changes lgtm, just need to tweak that doc before merge.

[ddl-ebrown]

Confirmed in a test environment with an infra upgrade that things check out with the 16 character id at the end

{
            "Effect": "Allow",
            "Principal": {
                "Federated": "accounts.google.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "accounts.google.com:aud": "flyte-awscp-flyte-gcp-a1e35ce69bb0ee86"
                }
            }
        }