WIP: Split AWS/IAM policies for master and workers

[rossf7]

Fixes #330

[rossf7]

Creating separate policies works but the worker policy now has restricted EC2 permissions. This is as per the cloud provider docs but I need to test the persistent volumes still work.

[hobti01]

@rossf7 could you please add the following to the policy on the master and workers to allow image pulling from ECR as implemented in kubernetes/kubernetes#19447 and kubernetes/kubernetes#24369

See also PR #364

{
"Effect": "Allow",
    "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:BatchGetImage"
    ],
    "Resource": "*"
}

[rossf7]

Hi @hobti01 I think it's best that this is handled as a separate change. Thanks for providing your PR we'll get that reviewed.

[rossf7]

Closing as this was implemented in #370. ECR permissions are now only applied to worker nodes.