[OPAL-7906] Support AWS accounts in Terraform

[andrewsy-opal]

Description of the change

We were out of parity with the SDK, this supports it.

Test AWS accounts:

Test AWS role:

Checklist

• I performed a self-review of my code
• I manually tested my code change (please list details in description)
• I added unit tests
• I updated the changelog
• I updated the public facing docs

[linear]

OPAL-7906 [P1] - Sophos | AWS Organizations - Terraform fails for Opal AWS IAM Role Resource

Terraform is failing for AWS Organizations using AWS IAM Roles:

TF update, I've tried to get the IAM Roles added via TF and get an error "Error: opal api error: 400 Bad Request: account_id is required for aws sso app" Looking at the API docs there is an option to add account_id for AWS_IAM_ROLE type Opal resource, https://docs.opal.dev/reference/createresource

"remote_info": { "aws_iam_role": { "account_id": 234234234234, "arn": "arn:aws:iam::179308207300:role/MyRole" } },
I've tried the API without the account_id and get the same error, so it looks like its required but not available in the TF provider, you can only specify the arn https://registry.terraform.io/providers/opalsecurity/opal/latest/docs/resources/resource#nested-schema-for-remote_infoaws_iam_role

Please can we get this added to the remaining TF provider work along with getting the "AWS_ACCOUNT" Opal resource type available in the TF provider, as they're both in the same area, thanks.

[ken-opal]

one question - do we want to support reading out the remote info for other AWS resources?

terraform-provider-opal/opal/resource.go

Lines 414 to 436 in 24eb7c5

	if resource.Metadata != nil {
	remoteInfoIList := make([]any, 0, 1)
	switch *resource.ResourceType {
	case opal.RESOURCETYPEENUM_AWS_SSO_PERMISSION_SET:
	// TODO: Handle other AWS Orgs resource types
	var metadata opal.AwsPermissionSetMetadata
	if err := json.Unmarshal([]byte(*resource.Metadata), &metadata); err != nil {
	return diagFromErr(ctx, err)
	}
	permissionSetIList := make([]any, 0, 1)
	permissionSetIList = append(permissionSetIList, map[string]any{
	"arn": metadata.AwsPermissionSet.Arn,
	"account_id": metadata.AwsPermissionSet.AccountId,
	})
	remoteInfoIList = append(remoteInfoIList, map[string]any{
	"aws_permission_set": permissionSetIList,
	})
	}
	if len(remoteInfoIList) == 1 {
	d.Set("remote_info", remoteInfoIList)
	}
	}

some more context here: https://github.com/opalsecurity/terraform-provider-opal/pull/19/files#r1205825077

[ken-opal]

LGTM with one comment on validating the import + plan workflow