fix: allow Jenkins build agents to discover FSx volumes/snapshots and make outbound Internet connections

[jorisdon]

Issue number: N/A

Summary

Changes

• Jenkins build agents EC2 instance profile can now invoke FSx's DescribeVolumes and DescribeSnapshots APIs without supplying a snapshot/volume filter. These APIs require IAM permissions on <...>:volume/*/* and <...>:snapshot/*.* in order to discover snapshots and volumes accordingly. The ability to discover snapshots and volumes through these APIs is needed by the FSx automounter scripts. Users that bake the FSx mount commands into their AMIs can remove or downscope these permissions.
• Jenkins build agents now have outbound internet access configured in their security groups, which is needed to pull repositories and install dependencies from the Internet at build-time.

User experience

No changes in user experience

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

(note: documentation changes not needed due to documentation automation / dependent on other PRs)

Is this a breaking change?

No

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created might not be successful.

[henrykie]

Thanks for the fix.