provision aws tokens for rust-lang/rust

[marcoieni]

Related to rust-lang/infra-team#188

This PR creates two new terragrunt states:

• /legacy/rustc-ci-staging/ to configure https://github.com/rust-lang/bors-kindergarten
• /legacy/rustc-ci-prod/ to configure https://github.com/rust-lang/rust

I copied terragrunt/modules/static-website from the corresponding terraform module as it wasn't in terragrunt yet.

Why I didn't setup the staging resources in the ci-staging account

1. The staging account doesn't have access to the rust-lang.org Route 53 Hosted Zone. This means it would be more complex to get this done because we would need to find a way to use a different domain (such as ci-staging.infra.rust-lang.org). Me and JD verified that in terragrunt this was never done.
2. In the future, we might want to move the prod resources to the ci-prod aws account. Having the staging resources in the legacy account and moving the staging resources to the ci-staging account first, is going to be handy to prevent possible issues that might happen to the prod resources.

Commands I ran to import the state in prod

### done (I already ran these commands) ###
terragrunt import aws_s3_bucket.inventories rust-inventories
terragrunt import aws_s3_bucket.artifacts rust-lang-ci2
terragrunt import aws_s3_bucket.caches rust-lang-ci-sccache2

# ID obtained from `terraform state show module.public.aws_s3_bucket_inventory.artifacts`
terragrunt import aws_s3_bucket_inventory.artifacts rust-lang-ci2:all-objects-csv

# ID obtained from `terraform state show 'module.public.aws_s3_bucket_policy.artifacts["true"]'`
terragrunt import aws_s3_bucket_policy.artifacts[0] rust-lang-ci2

# ID obtained from `terraform state show 'module.public.aws_s3_bucket_policy.caches["true"]'`
terragrunt import aws_s3_bucket_policy.caches[0] rust-lang-ci-sccache2

##### caches static website #####

# ID obtained from `terraform state show 'module.public.module.caches_cdn["true"].module.certificate.aws_acm_certificate.cert'`
AWS_REGION=us-east-1 tg import 'module.caches_cdn.module.certificate.aws_acm_certificate.cert' "arn:aws:acm:us-east-1:890664054962:certificate/e99c2320-f3e6-4bfb-b115-94bfc39a56d5"

# ID obtained from `terraform state show 'module.public.module.caches_cdn["true"].aws_route53_record.website'`
terragrunt import module.caches_cdn.aws_route53_record.website Z237AC8WS9NFCS_ci-caches.rust-lang.org_CNAME

# ID obtained from `terraform state show 'module.public.module.caches_cdn["true"].module.certificate.aws_route53_record.cert_validation["ci-caches.rust-lang.org"]'
terragrunt import 'module.caches_cdn.module.certificate.aws_route53_record.cert_validation["ci-caches.rust-lang.org"]' Z237AC8WS9NFCS__0062654447e2b1cc2c228f28a2ffd38d.ci-caches.rust-lang.org._CNAME

# ID obtained from `terraform state show 'module.public.module.caches_cdn["true"].aws_cloudfront_distribution.website'`
terragrunt import module.caches_cdn.aws_cloudfront_distribution.website E2SRGWG3SJFYDC

#### artifacts static website ######

# ID obtained from `terraform state show 'module.public.module.artifacts_cdn["true"].module.certificate.aws_acm_certificate.cert'`
terragrunt import 'module.artifacts_cdn.module.certificate.aws_acm_certificate.cert' "arn:aws:acm:us-east-1:890664054962:certificate/58cce1dd-adfa-4fd2-8cdd-539b89f5f500"

terragrunt import 'module.artifacts_cdn.aws_route53_record.website' Z237AC8WS9NFCS_ci-artifacts.rust-lang.org_CNAME

terragrunt import 'module.artifacts_cdn.module.certificate.aws_route53_record.cert_validation["ci-artifacts.rust-lang.org"]' 'Z237AC8WS9NFCS__d8b0665760c58453311c4c28e03e32d2.ci-artifacts.rust-lang.org._CNAME'

terragrunt import module.artifacts_cdn.aws_cloudfront_distribution.website E3OK0DB0OA1ZDV

Resources that we want to create

• aws_cloudfront_response_headers_policy.s3 (it's not in the terraform state)
• aws_iam_role.try_builds
• aws_iam_role_policy.try_builds
• aws_iam_user_policy.artifacts_write
• aws_iam_user_policy.caches_write
• aws_s3_bucket_acl.artifacts (the aws_s3_bucket_acl needs to be created because I fixed a warning in the terraform code).
• aws_s3_bucket_acl.caches
• aws_s3_bucket_lifecycle_configuration.artifacts_lifecycle (the aws_s3_bucket_lifecycle_configuration needs to be created because I fixed a warning in the terraform code).
• aws_s3_bucket_lifecycle_configuration.caches_lifecycle
• module.artifacts_user.aws_iam_access_key.ci
• module.artifacts_user.aws_iam_user.ci
• module.artifacts_user.github_actions_environment_secret.aws_access_key_id[0]
• module.artifacts_user.github_actions_environment_secret.aws_secret_access_key[0]
• module.caches_user.aws_iam_access_key.ci
• module.caches_user.github_actions_environment_secret.aws_access_key_id[0]
• module.caches_user.github_actions_environment_secret.aws_secret_access_key[0]
• module.caches_cdn.module.certificate.aws_acm_certificate_validation.cert (if imported, terraform errors: resource aws_acm_certificate_validation doesn't support import)

What do to after this PR is approved

• apply staging
• apply prod

[marcoieni]

this allows to update to versions >= 6.3

[marcoieni]

is Delete needed? I copied because it was already there, but I don't think the CI needs to delete objects 🤔

Same for the caches bucket.

[marcoieni]

This iam_prefix should guarantee that the iam stuff doesn't conflict with the existing one in the legacy account

[marcoieni]

applied to staging

https://github.com/rust-lang/bors-kindergarten/settings/secrets/actions