Modify service module to support external ECS execution and task roles

[klejejs]

This PR modifies the service module to support external ECS execution and task roles to be defined for the service and prevent module policy creation. This is useful for services like stun_server, which runs in multiple regions, but IAM roles need to be created only in one.

I tried defining policy creation in the service module (count value) based on the role variable values passed to the module; however, because roles have to be created first, Terraform could not determine the actual variable values during the run, and I had to implement a separate create_policies variable instead.

[ludeeus]

This should be calculated, there should be no need to pass this and the ARN.

[klejejs]

I tried it (described in the PR description), and it did not work. I'll check if it works if we pass the role name and use it a data source as you suggested.

[klejejs]

It looks like it works if a name is passed and used for the data source instead of passing the ARN directly. Thanks for the tip!

[ludeeus]

Pass the role name and use the data source to fetch the arn, that makes the rest of the code more readable as that can determine which role to get (local/external) based on if this is passed or not.

[klejejs]

Do you think we should rename the local role as well? E.g., add -local?

[bemble]

As policies are global, why keeping them into the module directory and try to find a workaround to get it working?