Allow creation of CloudWatch logging, additional policy attachment, and KMS decryption

[LawrenceWarren]

what

• Allow optional creation of a CloudWatch logs natively within the module, as logging for Bastion nodes is a common requirement
• Expand the user_data/amazon-linux.sh script to enable debug logging.
• Allow optional attachment of additional IAM policies, via a list of provided policy ARNs, so that the bation can optionally have more access
• Allow optional KMS decryption on the bastion

why

• Simply, these all seem like sensible options to provide users, and are common use-cases that my company use on our internal fork.
• These changes are not breaking.

[LawrenceWarren]

/terratest

[hans-d]

/terratest

[mergify[bot]]

Thanks @LawrenceWarren for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

[!TIP]

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.