feat: add time zone support for pool schedules

[janslow]

Fixes #4056

The timezone can be set via the schedule_expression_timezone property via the main module or multi-runners module.

Replaces the aws_cloudwatch_event_rule in the pool module (which only support UTC) with aws_scheduler_schedule, which supports arbitrary time zones via the schedule_expression_timezone attribute.

In this situation AWS EventBridge Scheduler is a drop in replacement for schedule-based AWS EventBridge Rules (see AWS blog post), including the expression syntax and pricing. The main (internal) difference is that AWS Scheduler requires the use of an IAM Role, instead of Lambda permissions.

[janslow]

Note, I've tried to run the GitHub Action to update the auto-generated Terraform Docs (as per the contribution guide), but it's failing because it requires credentials that I don't have access to.

In terms of testing, I couldn't find any existing automated tests for the pool, although I have tested it on my existing install (both with and without the new property)

[npalm]

Note, I've tried to run the GitHub Action to update the auto-generated Terraform Docs (as per the contribution guide), but it's failing because it requires credentials that I don't have access to.

Terraform docs will updated on either release or main branch. Feel free to create an issue to address the shortcoming in the release notes

In terms of testing, I couldn't find any existing automated tests for the pool, although I have tested it on my existing install (both with and without the new property)

We only have automated tests for the lambda's, not for the full module. We doe typically a manual test dependending on the change with one of the examples. Would be great if we have an full auto test test. Any idea would be welcome how to run auto tests for IaC on an OS repo in a secure way.

[janslow]

Feel free to create an issue to address the shortcoming in the release notes

👍 I've created a PR to remove the reference from the contribution guide, as it's no longer relevant when creating a PR.

[janslow]

Would be great if we have an full auto test test. Any idea would be welcome how to run auto tests for IaC on an OS repo in a secure way.

Unfortunately, I'm not aware of any magic solution.

For internal apps, I've used Terratest to spin up ephemeral environments that are realistic, then run integration tests against them. I think that'd be tricky for this project though, especially given the fact it's a public project.

One possibility could be to use Terraform's native test features to plan the example modules (using mock providers, so no AWS access is required), then running assertions against it. For example, asserting that all of the aws_iam_role resources have the correct path/permissions boundary (which I originally forgot in my PR).

[npalm]

Would be great if we have an full auto test test. Any idea would be welcome how to run auto tests for IaC on an OS repo in a secure way.

Unfortunately, I'm not aware of any magic solution.

For internal apps, I've used Terratest to spin up ephemeral environments that are realistic, then run integration tests against them. I think that'd be tricky for this project though, especially given the fact it's a public project.

One possibility could be to use Terraform's native test features to plan the example modules (using mock providers, so no AWS access is required), then running assertions against it. For example, asserting that all of the aws_iam_role resources have the correct path/permissions boundary (which I originally forgot in my PR).

Thanks for the feedback! That was also my take and the reason why there no intergration tests (yet). Internally for the runners we deploy to a staging and ran validation workflows as verification. All automated.

[npalm]

Thanks, nice contribution. Tiny suggestion.

[npalm]

Tested with ephemeral example, works as expected.

[janslow]

Thanks for the review, I've accepted your suggestion

[npalm]

Thanks for adding the feature! Feel free to update the other time triggers as well!