message: [terraform] Use aws_iam_policy_document
  This is nice than handwritten JSON.
  Test Plan: `terraform plan` on dev workspace, only change is document
  version 2008-10-17 -> 2012-10-17.
diff: -resource "aws_iam_role" "ecsInstanceRole" {
  - name = "${terraform.workspace}-ecsInstanceRole"
  +data "aws_iam_policy_document" "instance-assume-role" {
  + statement {
  + actions = ["sts:AssumeRole"]
  - assume_role_policy = <<EOF
  -{
  - "Version": "2008-10-17",
  - "Statement": [
  - {
  - "Sid": "",
  - "Effect": "Allow",
  - "Principal": {
  - "Service": "ec2.amazonaws.com"
  - },
  - "Action": "sts:AssumeRole"
  + principals {
  + type = "Service"
  + identifiers = ["ec2.amazonaws.com"]
  + }
  }
  - ]
  }
  -EOF
  +resource "aws_iam_role" "ecsInstanceRole" {
  + name = "${terraform.workspace}-ecsInstanceRole"
  + assume_role_policy = data.aws_iam_policy_document.instance-assume-role.json
  }
  resource "aws_iam_role_policy_attachment" "ecsInstanceRole" {
  @@ -46,25 +41,20 @@ resource "aws_iam_instance_profile" "ecsInstanceRole" {
  role = aws_iam_role.ecsInstanceRole.name
  }
  -resource "aws_iam_role" "ecsTaskExecutionRole" {
  - name = "${terraform.workspace}-ecsTaskExecutionRole"
  +data "aws_iam_policy_document" "task-assume-role" {
  + statement {
  + actions = ["sts:AssumeRole"]
  - assume_role_policy = <<EOF
  -{
  - "Version": "2008-10-17",
  - "Statement": [
  - {
  - "Sid": "",
  - "Effect": "Allow",
  - "Principal": {
  - "Service": "ecs-tasks.amazonaws.com"
  - },
  - "Action": "sts:AssumeRole"
  + principals {
  + type = "Service"
  + identifiers = ["ecs-tasks.amazonaws.com"]
  + }
  }
  - ]
  }
  -EOF
  +resource "aws_iam_role" "ecsTaskExecutionRole" {
  + name = "${terraform.workspace}-ecsTaskExecutionRole"
  + assume_role_policy = data.aws_iam_policy_document.task-assume-role.json
  }
  resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole" {
  @@ -76,29 +66,16 @@ locals {
  secrets_arn = split(":", aws_secretsmanager_secret.validator[0].arn)
  }
  +data "aws_iam_policy_document" "validator" {
  + statement {
  + actions = ["secretsmanager:GetSecretValue"]
  + resources = ["${join(":", slice(local.secrets_arn, 0, length(local.secrets_arn) - 1), )}:*"]
  + }
  +}
  +
  resource "aws_iam_policy" "validator" {
  name = "${terraform.workspace}-validator"
  -
  - policy = <<EOF
  -{
  - "Version": "2012-10-17",
  - "Statement": [
  - {
  - "Effect": "Allow",
  - "Action": [
  - "secretsmanager:GetSecretValue"
  - ],
  - "Resource": [
  - "${join(
  - ":",
  - slice(local.secrets_arn, 0, length(local.secrets_arn) - 1),
  -)}:*"
  - ]
  - }
  - ]
  -}
  -EOF
  -
  + policy = data.aws_iam_policy_document.validator.json
  }
  resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole-secrets" {
  