feat(identity-access-control): add module to configure the AWS IAM provider

[davidf-null]

Summary

Adds a new cloud-agnostic module nullplatform/identity-access-control that configures an identity & access control provider in nullplatform through a nullplatform_provider_config resource.

The provider type and attributes are exposed as variables so new clouds can be onboarded without changing the module. type defaults to the AWS IAM provider (aws-iam-configuration), confirmed live via the nullplatform API (there is no provider literally named identity-access-control).

For AWS, this is the platform-side counterpart to infrastructure/aws/iam/agent, which grants the agent sts:AssumeRole over the published role ARNs.

Inputs

Name	Type	Default	Required
nrn	string	—	yes
attributes	any	—	yes
type	string	"aws-iam-configuration"	no
dimensions	map(string)	{}	no

attributes is JSON-encoded as-is to match the selected provider specification's schema. For aws-iam-configuration:

attributes = {
  iam_role_arns = {
    arns = [
      { selector = "billing", arn = "arn:aws:iam::123456789012:role/billing-reader" }
    ]
  }
}

Onboarding a new cloud is just a different type + attributes:

type       = "azure-iam-configuration"
attributes = { /* azure-iam-configuration schema */ }

Design notes

• Cloud-agnostic by design: no cloud-specific attribute validation in the module; the caller owns attribute shape. Trade-off: drops the AWS-only ARN validation in exchange for zero module changes per new cloud.
• No ignore_changes on attributes (unlike metrics/code_repository, which suppress drift for externally-rotated secrets): this config is declarative identity/access data, so Terraform stays the source of truth.
• Follows existing nullplatform/* provider-config conventions.

Testing

• tofu fmt, tofu validate, tofu test pass (also enforced via pre-commit hooks).
• 3 tests: default type, custom type (new cloud), and JSON-encoded attributes.

tests/identity_access_control.tftest.hcl... pass
  run "default_type_is_aws_iam_configuration"... pass
  run "custom_type_for_new_cloud"... pass
  run "attributes_are_json_encoded"... pass
Success! 3 passed, 0 failed.

🤖 Generated with Claude Code