feat: add inline policy document support to IAM role creation

internal/activities/aws.go

@@ -504,6 +504,21 @@ func (a *AWSActivities) CreateIAMRole(
 		}
 	}
 
+	for _, p := range input.InlinePolicies {
+		if _, err = client.PutRolePolicy(ctx, &iam.PutRolePolicyInput{
+			RoleName:       aws.String(input.RoleName),
+			PolicyName:     aws.String(p.Name),
+			PolicyDocument: aws.String(p.Document),
+		}); err != nil {
+			return "", fmt.Errorf(
+				"put inline policy %s on role %s: %w",
+				p.Name,
+				input.RoleName,
+				err,
+			)
+		}
+	}
+
 	return *out.Role.Arn, nil
 }
 
@@ -513,6 +528,22 @@ func (a *AWSActivities) DeleteIAMRole(ctx context.Context, input DeleteIAMRoleIn
 		return err
 	}
 
+	inlinePolicies, err := client.ListRolePolicies(
+		ctx,
+		&iam.ListRolePoliciesInput{RoleName: aws.String(input.RoleName)},
+	)
+	if err != nil {
+		return fmt.Errorf("list inline policies for role %s: %w", input.RoleName, err)
+	}
+	for _, name := range inlinePolicies.PolicyNames {
+		if _, err = client.DeleteRolePolicy(ctx, &iam.DeleteRolePolicyInput{
+			RoleName:   aws.String(input.RoleName),
+			PolicyName: aws.String(name),
+		}); err != nil {
+			return fmt.Errorf("delete inline policy %s from role %s: %w", name, input.RoleName, err)
+		}
+	}
+
 	policies, err := client.ListAttachedRolePolicies(
 		ctx,
 		&iam.ListAttachedRolePoliciesInput{RoleName: aws.String(input.RoleName)},

internal/activities/inputs.go

@@ -88,13 +88,19 @@ type DeleteVPCInput struct {
 	VpcID  string
 }
 
+type InlinePolicy struct {
+	Name     string
+	Document string // JSON policy document
+}
+
 type CreateIAMRoleInput struct {
-	RoleName    string
-	Description string
-	TrustPolicy string
-	PolicyARNs  []string
-	Environment string
-	Team        string
+	RoleName       string
+	Description    string
+	TrustPolicy    string
+	PolicyARNs     []string
+	InlinePolicies []InlinePolicy
+	Environment    string
+	Team           string
 }
 
 type DeleteIAMRoleInput struct {