Fix overscoped json policies in CI

[samuel40791765]

Issues:

Resolves V1177876714

Description of changes:

There were a few overscoped IAM policies in our CI. Best practice is to minimize permissions, so we're enforcing that here.

• I've moved some of the ec2 resource creations to cdk instead of the original cli methods. The framework should be able to access these via Codebuild environment variables.
• I checked our S3 bucket policies, but discovered that the automated windows docker doesn't work anymore. This was due to docker not being installed by default. The new minimal S3 permissions work, but I've left a TODO to fix this later on.

Call-outs:

N/A

Testing:

"Works in my account": samuel40791765#31

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 76.96%. Comparing base (1af7018) to head (5b6ff9f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1494      +/-   ##
==========================================
- Coverage   76.99%   76.96%   -0.04%     
==========================================
  Files         425      425              
  Lines       71556    71556              
==========================================
- Hits        55097    55070      -27     
- Misses      16459    16486      +27     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.