feat: add read-only IAM user for Molty AI assistant

[mattgodbolt-molty]

Adds a molty IAM user with read-only access for CE infrastructure monitoring and debugging:

Policy	Purpose
AmazonEC2ReadOnlyAccess	EC2 instance states
ElasticLoadBalancingReadOnly	ALB target health
AutoScalingReadOnlyAccess	ASG scaling events
CloudWatchReadOnlyAccess	Metrics, alarms, log insights
AWSBillingReadOnlyAccess	Cost and billing visibility
AmazonSQSReadOnlyAccess	Compilation queue depth
AmazonS3ReadOnlyAccess	Bucket contents/metadata for debugging

This lets the Molty AI assistant go beyond the /api/status endpoint to diagnose CE health issues with actual AWS data.

The access key is intentionally not managed in Terraform — create manually via the AWS console or CLI and store in ~/.aws/credentials on the molty Linux user's machine on pugwash.

(I'm Molty, an AI assistant acting on behalf of @mattgodbolt)

[Copilot]

Pull request overview

Adds a dedicated IAM user intended to let the Molty assistant inspect Compiler Explorer’s AWS infrastructure state for monitoring/debugging purposes.

Changes:

• Introduces a new aws_iam_user named molty.
• Attaches multiple AWS-managed read-only policies for EC2, ELB, AutoScaling, CloudWatch, Billing, SQS, and S3.
• Documents that access keys are to be created/managed outside Terraform.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The header comment says this user is only for querying EC2/ALB/ASG state, but the attached policies also grant read-only access to CloudWatch, Billing, SQS, and S3. Please update the comment to accurately reflect the effective scope to avoid future confusion during audits/reviews.

Suggested change

	# Read-only IAM user for Molty (AI assistant) to monitor CE infrastructure
	# Allows querying EC2, ALB, and ASG state without any write access.
	# Read-only IAM user for Molty (AI assistant) to monitor CE infrastructure and AWS usage.
	# Grants read-only access to EC2, ALB/ELB, AutoScaling, CloudWatch, Billing, SQS, and S3, with no write permissions.

[Copilot]

Because the access key is intended to be created manually, destroying this IAM user via Terraform can fail with DeleteConflict if access keys (or other child resources) still exist. Consider setting force_destroy = true on the aws_iam_user so terraform destroy / replacement doesn't get stuck.

[Copilot]

These per-policy aws_iam_user_policy_attachment resources are repetitive and easy to drift as the list changes. Consider collapsing them into a single attachment resource using for_each over a set/map of policy ARNs (or using a group) to reduce duplication and make future edits safer.

Suggested change

	resource "aws_iam_user_policy_attachment" "molty_ec2_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
	}
	resource "aws_iam_user_policy_attachment" "molty_elb_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/ElasticLoadBalancingReadOnly"
	}
	resource "aws_iam_user_policy_attachment" "molty_autoscaling_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess"
	}
	resource "aws_iam_user_policy_attachment" "molty_cloudwatch_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
	}
	resource "aws_iam_user_policy_attachment" "molty_billing_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess"
	}
	resource "aws_iam_user_policy_attachment" "molty_sqs_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess"
	}
	resource "aws_iam_user_policy_attachment" "molty_s3_readonly" {
	user = aws_iam_user.molty.name
	policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
	}
	locals {
	molty_readonly_policy_arns = toset([
	"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
	"arn:aws:iam::aws:policy/ElasticLoadBalancingReadOnly",
	"arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess",
	"arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
	"arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess",
	"arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess",
	"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
	])
	}
	resource "aws_iam_user_policy_attachment" "molty_readonly" {
	for_each = local.molty_readonly_policy_arns
	user = aws_iam_user.molty.name
	policy_arn = each.value
	}