Support ignoring resources by tag or name to prevent IAMbic from syncing these resources about iambic

[castrapel]

CC @datfinesoul

[datfinesoul]

After #388 is implemented it will be easier to provide more detailed feedback as to how this would be useful. IMO it would be worth holding off until that one is done.

[castrapel]

Internally, we're talking about a provider-agnostic way to ignore resources. A Pydantic model might look something like the following:

class ExcludedResources(BaseModel):
    """
    The ExcludedResources class allows you to specify resources that should be excluded during the template generation process in IAMbic. This class provides a provider-agnostic mechanism to selectively ignore resources based on their attributes, such as template types, names, paths, and tags.

    The exclusion criteria are defined using regular expressions, offering flexible matching capabilities. You can define multiple criteria within each attribute, and a resource must match all specified criteria to be excluded.

    The exclusion logic works based on the AND/OR boolean logic. For instance, if you specify multiple tags, a resource will be excluded if it matches the template type AND any of the specified tags. 

    Attributes:
    template_types: A list of template types to exclude. These should be defined in the form of regular expressions.
    names: A list of resource names to exclude. These should be defined in the form of regular expressions.
    paths: A list of paths to exclude. These should be defined in the form of regular expressions.
    tags: A list of tags to exclude. Each tag is a dictionary with a 'key' and 'value', both of which should be defined in the form of regular expressions.
    """
    template_types: Optional[list[str]] = Field(
        description="A list of template types to exclude. Regular expressions are supported for defining the types."
    )
    names: Optional[list[str]] = Field(
        description="A list of resource names to exclude. Regular expressions are supported for defining the names."
    )
    paths: Optional[list[str]] = Field(
        description="A list of paths to exclude. Regular expressions are supported for defining the paths."
    )
    tags: Optional[list[dict]] = Field(
        description="A list of tags to exclude. Each tag is a dictionary with 'key' and 'value' fields, both supporting regular expressions."
    )

Example template:

template_type: NOQ::Core::Config
version: '1'
core:
  exclude_resources:
    - template_types: 
        - 'NOQ::AWS::IAM::Role'
      names:
        - 'amplify-.*'
    - template_types:
        - 'NOQ::AWS::IAM::Role'
      paths:
        - '/aws-reserved/.*'
        - '/cdk/.*'
    - template_types:
        - 'NOQ::AWS::.*'
      tags:
        - key: 'aws:cloudformation:stack-name'
          value: '.*'
        - key: 'aws:cdk:asset'

[castrapel]

Another option we discussed in Slack
(Join here) is a configuration specific to a provider. This would be an easier change because the AWS configuration is already passed around to the AWS provider plugin.

import_rules:
  - match_tags:
      - key: terraform
        # optional `value` field
    action: iambic_managed.import_only
  - match_names:
      - "AWS SSO Role*"
      - "CDK*"
      - "CloudFormation*"
    action: ignore
  - match_paths:
      - "/service-role/*"
    action: ignore
  - match_tags:
      - key: "ManagedBy"
        value: "CDK"
    action: ignore
  - match_template_types:
      - "NOQ::AWS::IAM::ManagedPolicy"
    action: iambic_managed.import_only