User-controlled resources for permission type C

[cliffano]

Since permission type C does not allow the creation of instance profiles, roles, and DNS, we need the ability to create a CF stack which contains IAM and Route53 resources.

This is handy for performing permission type C integration testing on sandpit. So for sandpit testing, we should be able to create those user-owned resources.

As for real user scenario, they own and manage the IAM and Route53 themselves.