Add missing policy for CfnCluster user profile

"ec2:CreatePlacementGroup" and "ec2:DeletePlacementGroup" used
when setting the placement group config to be DYNAMIC

"iam:GetRole" and "iam:SimulatePrincipalPolicy" used when setting
a custom instance role

Signed-off-by: Luca Carrogu <[email protected]>

Author: lukeseawalker

docs/source/iam.rst

@@ -8,7 +8,7 @@ IAM in CfnCluster
 
 
 CfnCluster utilizes multiple AWS services to deploy and operate a cluster. The services used are listed in the :ref:`AWS Services used in CfnCluster <aws_services>` section of the documentation.
- 
+
 CfnCluster uses EC2 IAM roles to enable instances access to AWS services for the deployment and operation of the cluster. By default the EC2 IAM role is created as part of the cluster creation by CloudFormation. This means that the user creating the cluster must have the appropriate level of permissions
 
 Defaults
@@ -176,7 +176,9 @@ CfnClusterUserPolicy
                   "ec2:DeleteSecurityGroup",
                   "ec2:DisassociateAddress",
                   "ec2:RevokeSecurityGroupIngress",
-                  "ec2:ReleaseAddress"
+                  "ec2:ReleaseAddress",
+                  "ec2:CreatePlacementGroup",
+                  "ec2:DeletePlacementGroup"
               ],
               "Effect": "Allow",
               "Resource": "*"
@@ -308,7 +310,9 @@ CfnClusterUserPolicy
               "Action": [
                   "iam:PassRole",
                   "iam:CreateRole",
-                  "iam:DeleteRole"
+                  "iam:DeleteRole",
+                  "iam:GetRole",
+                  "iam:SimulatePrincipalPolicy"
               ],
               "Effect": "Allow",
               "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:role/<CFNCLUSTER EC2 ROLE NAME>"