Fix cdk exec policy for bootstraping linked accounts (#763)

[noah-paige]

Feature or Bugfix

• Enhancement

Detail

Remove overly permissive permissions in the optional cdk execution bootstrapping policy

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?

NA

• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?

NA

• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?

NA

• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

Adding additional restrictions to permission set for cdk execution bootstrapping policy when bootstrapping / linking environments

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[noah-paige]

Tested in AWS Deployment For:

• Create, Update, Delete Linked Environment
  • Same Region as Deployment Acct
  • All Features Enabled + No Default VPC
• Create, Update, Delete Linked Environment
  • Cross Region as Deployment Acct
  • All Features Enabled + Default VPC
• Create, Delete Dataset
• Create, Delete Notebook
• Create, Delete MLStudio User
• Create, Delete CDK Pipeline
• Create, Delete Trunk-Based Pipeline
• Create, Delete Gitflow Pipeline