Initial attempt at split policy

[jhpyke]

Pull Request Objective

This piece of work is being tracked in
this
GitHub Issue.

This attempts to split the roles for CaDeT into a more limited dev role, and a more highly empowered prod one, in order to allow the prod role to be restricted to a specific runner group (and as such, allow us to put rules on that runner group to ensure it can only target named workflows@main when running. This is in addition to implementing environments to the repo itself, as those can be overridden by user changes.

Checklist

Note

Each items should be checked. Skipping below checks could delay your PR review!

• I have reviewed the style guide
  and ensured that my code complies with it
• All checks have passed (or override label applied, if I've
  used the override-static-analysis label, I've explained why)
• I have self-reviewed my code
• I have reviewed the checks and can attest they're as expected

Additional Comments

Lemme know if you've got any questions.

[github-actions]

Terraform Component 🧱: aws-analytical-platform-data-production-github-actions-roles

Checkov 🛂: success

Trivy 🛂: success

Static Analysis Override Label 🏷️: false

Pusher: @jhpyke, Action: pull_request, Working Directory: terraform/aws/analytical-platform-data-production/github-actions-roles, Workflow: Terraform, Marker: aws-analytical-platform-data-production-github-actions-roles_static_analysis

[github-actions]

Terraform Component 🧱: aws-analytical-platform-data-production-github-actions-roles

Terraform Initialization ⚙️: success

Terraform Validation 🤖: success

Terraform Plan 🛠️: success

Pusher: @jhpyke, Action: pull_request, Working Directory: terraform/aws/analytical-platform-data-production/github-actions-roles, Workflow: Terraform, Marker: aws-analytical-platform-data-production-github-actions-roles_plan

[jacobwoffenden]

add dev to this