code: def create_role_and_policy(
      iam_client: botocore.client.BaseClient, project_id: str
  ) -> str:
      policy_name = (
          "dstack_policy_" + project_id.replace("-", "_").lower()
      )
      role_name = "dstack_role_" + project_id.replace("-", "_").lower()
  
      try:
          iam_client.get_role(RoleName=role_name)
          return role_name
      except botocore.exceptions.ClientError as e:
          if e.response["Error"]["Code"] != "NoSuchEntity":
              raise e
  
      response = iam_client.create_policy(
          PolicyName=policy_name,
          Description="Generated by dstack",
          PolicyDocument=json.dumps(
              {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Effect": "Allow",
                          "Action": "ec2:*",
                          "Resource": "*",
                          "Condition": {
                              "StringEquals": {
                                  "aws:ResourceTag/dstack_project": project_id,
                              }
                          },
                      },
                  ],
              }
          ),
          Tags=[
              {"Key": "owner", "Value": "dstack"},
              {"Key": "dstack_project", "Value": project_id},
          ],
      )
      policy_arn = response["Policy"]["Arn"]
      iam_client.create_role(
          RoleName=role_name,
          AssumeRolePolicyDocument=json.dumps(
              {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Action": "sts:AssumeRole",
                          "Effect": "Allow",
                          "Principal": {"Service": "ec2.amazonaws.com"},
                      }
                  ],
              }
          ),
          Description="Generated by dstack",
          MaxSessionDuration=3600,
          Tags=[
              {"Key": "owner", "Value": "dstack"},
              {"Key": "dstack_project", "Value": project_id},
          ],
      )
      iam_client.attach_role_policy(
          RoleName=role_name, PolicyArn=policy_arn
      )
      return role_name
  
file_path: dstack/src/dstack/_internal/core/backends/aws/resources.py
imports: import json
  from typing import Any, Dict, List, Optional
  import botocore.client
  import botocore.exceptions
  import dstack.version
  from dstack._internal.core.errors import ResourceNotFoundError
label_desc: Use image node_id 2 for calling a global function with example usage: create_role_and_policy(iam_client, project_id) and returns: role_name, role_name