[Feature] Updated AWS UC storage credential to include permissions for file events

[borremosch-db]

Changes

Databricks documentation for storage credentials contains instructions to add permissions for file events, but as of yet these are missing from the terraform provider. This PR adds them for AWS. PRs for Azure and GCP will follow soon

Tests

Updated test: aws/data_aws_unity_catalog_policy_test.go

• make test run locally
• relevant change in docs/ folder
• covered with integration tests in internal/acceptance
• using Go SDK
• using TF Plugin Framework

[mgyucht]

Would be good to get @alexott or @nkvuong's thoughts on this change. Would we want to allow users to opt out of this?

[borremosch-db]

@mgyucht thanks for the review. Ideally we would not make these changes opt-in/out as we're moving towards making file events mandatory (see PRD: Maximizing coverage of managed file events)

[borremosch-db]

@mgyucht @nkvuong could you have another look at this?

[mgyucht]

I think we can make the requested resources slightly narrower, which would be marginally better from a security stance. Otherwise, seems OK to me.

[mgyucht]

In the other policies, we restrict the resource templates to a single account. Can we do that here as well for consistency, or do we need to allow access to all accounts? (Understanding that this would also require cross-account policy on the target account, but with defence in depth in mind, we shouldn't force people to give broader access than necessary.) Ditto for the other resources. We already accept awsAccountId as a parameter.

[borremosch-db]

@mgyucht I considered scoping down to the account, but this is not the case for the S3 permissions in this specific file and I believe we should align the new permissions because they're targeting resources for the same use case.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/terraform

Inputs:

• PR number: 4406
• Commit SHA: 0fb1ec4d2cd97109d1e626bc782c9380700eb167

Checks will be approved automatically on success.