MEM-1138: Add IRSA to info and advice datastore - UAT

[Ian King (ian-antking)]

Adds RDS IAM authentication and moves the Microsoft Entra OAuth2 config into
AWS Secrets Manager for the UAT environments.

• rds-postgres.tf -- enables IAM auth on the RDS instance (enable_irsa = true)
  and grants the rds_iam role to the database user
• irsa.tf (new) -- creates a Kubernetes service account annotated with an IAM
  role scoped to rds-db:connect for this instance
• versions.tf / main.tf -- adds the cyrilgdn/postgresql provider
• variables.tf -- adds eks_cluster_name, required by the IRSA module

The existing rds-postgresql-instance-output k8s secret is unchanged -- username
and password remain available for dev access to these environments.

[github-actions]

This PR affects multiple namespaces

• laa-info-and-advice-datastore-staging
• laa-info-and-advice-datastore-uat
  Please submit a separate PR for each namespace.

[Sablu M (sablumiah)]

Terraform Plan Summary

Terraform Plan: 17 to be created, 0 to be destroyed, 1 to be updated, 0 to be replaced and 25 unchanged.

Resources to create:

+ kubernetes_secret.irsa
+ module.irsa.kubernetes_service_account.generated_sa
+ module.irsa.module.iam_assumable_role.aws_iam_role.this[0]
+ module.irsa.module.iam_assumable_role.aws_iam_role_policy_attachment.this["rds"]
+ module.irsa.random_id.id
+ module.rds.aws_iam_policy.irsa[0]
+ module.secrets_manager.aws_iam_policy.irsa_policy
+ module.secrets_manager.aws_secretsmanager_secret.secret["laa-info-and-advice-datastore-entra-staging"]
+ module.secrets_manager.kubernetes_manifest.external_secrets["laa-info-and-advice-datastore-entra-staging"]
+ module.secrets_manager.kubernetes_manifest.secret_store
+ module.secrets_manager.module.irsa.kubernetes_service_account.generated_sa
+ module.secrets_manager.module.irsa.module.iam_assumable_role.aws_iam_role.this[0]
+ module.secrets_manager.module.irsa.module.iam_assumable_role.aws_iam_role_policy_attachment.this["irsa"]
+ module.secrets_manager.module.irsa.random_id.id
+ module.secrets_manager.random_id.secret_name["laa-info-and-advice-datastore-entra-staging"]
+ module.secrets_manager.random_id.serviceaccount_id
+ postgresql_grant_role.rds_iam

Resources to update:

! module.rds.aws_db_parameter_group.custom_parameters

[Sablu M (sablumiah)]

Terraform Plan Summary

Terraform Plan: 17 to be created, 0 to be destroyed, 1 to be updated, 0 to be replaced and 25 unchanged.

Resources to create:

+ kubernetes_secret.irsa
+ module.irsa.kubernetes_service_account.generated_sa
+ module.irsa.module.iam_assumable_role.aws_iam_role.this[0]
+ module.irsa.module.iam_assumable_role.aws_iam_role_policy_attachment.this["rds"]
+ module.irsa.random_id.id
+ module.rds.aws_iam_policy.irsa[0]
+ module.secrets_manager.aws_iam_policy.irsa_policy
+ module.secrets_manager.aws_secretsmanager_secret.secret["laa-info-and-advice-datastore-entra-uat"]
+ module.secrets_manager.kubernetes_manifest.external_secrets["laa-info-and-advice-datastore-entra-uat"]
+ module.secrets_manager.kubernetes_manifest.secret_store
+ module.secrets_manager.module.irsa.kubernetes_service_account.generated_sa
+ module.secrets_manager.module.irsa.module.iam_assumable_role.aws_iam_role.this[0]
+ module.secrets_manager.module.irsa.module.iam_assumable_role.aws_iam_role_policy_attachment.this["irsa"]
+ module.secrets_manager.module.irsa.random_id.id
+ module.secrets_manager.random_id.secret_name["laa-info-and-advice-datastore-entra-uat"]
+ module.secrets_manager.random_id.serviceaccount_id
+ postgresql_grant_role.rds_iam

Resources to update:

! module.rds.aws_db_parameter_group.custom_parameters