replace iam user with role

[psi]

• Upgrade Terraform to 1.x with modern provider sources
• Update bootstrap-templates workflow to test
• Replace deprecated jakejarvis/s3-sync-action with aws cli
• Remove test bits from bootstrap-templates workflow

JIRA

• https://getbridge.atlassian.net/browse/PIER-1060

Changes

• Replaces the use of static IAM credentials w/ dynamic OIDC credentials
• Does NOT yet fully remove the existing credentials, which will be done in a follow up PR

Checklist

• • Feature Flag Required
• • Bug

Test plan

• • Walk-through
• • Peer review
• • Inspection
• Detailed steps and prerequisites for validating the change:
  • See https://github.com/get-bridge/truss-cli/actions/runs/28032867299 for a successful run to a dummy directory

Risk Analysis - the risk of change is evaluated

• • Low - Majority of the changes are low risk which doesn’t require extra testing, only code review by 1 reviewer
    • • 1 reviewer
• • Medium - Some portions of changes are medium risk which needs peer testing and review by 2 reviewers
    • • 2 reviewers
    • • peer testing
• • High - A very few breaking changes are high risk and need very throughout testing and review and also a coordinated release process.
    • • 2 reviewers
    • • peer testing
    • • coordinated release

[psi]

After moving the IAM role bits to central-infra, I temporarily re-allowed this branch to assume creds and re-tested here:

https://github.com/get-bridge/truss-cli/actions/runs/28112327730/job/83242703911

The related central-infra PR is here: https://github.com/get-bridge/central-infra/pull/93