[K9VULN-11615] Add SecurityAudit policy attachment to agentless scanning templates

[k3nz0]

Summary

• Enhances the existing datadog_agentless_api_call.py Lambda to attach the SecurityAudit AWS managed policy to the Datadog integration role during stack creation, which is required for agentless scanning
• Adds ensure_security_audit_policy() function that checks if SecurityAudit is already attached (idempotent) and attaches it if missing, with graceful skip when no role name is provided
• Adds scoped IAM permissions (iam:ListAttachedRolePolicies, iam:AttachRolePolicy restricted to SecurityAudit ARN) to the Lambda execution role in all three agentless templates
• For delegate role templates, the DatadogIntegrationRoleName parameter is optional — when empty, the IAM policy resource is not created and the Lambda skips attachment

Templates modified

• datadog_agentless_scanning.yaml — IAM policy + custom resource properties
• datadog_agentless_delegate_role.yaml — parameter + condition + IAM policy + custom resource properties + metadata
• datadog_agentless_delegate_role_stackset.yaml — same as delegate role

Test plan

• Unit tests pass (5 new tests for ensure_security_audit_policy: already-attached, not-attached, empty role name, error propagation, GovCloud partition)
• cfn-lint on all three modified YAML templates
• Deploy datadog_agentless_scanning.yaml and verify SecurityAudit is attached to integration role
• Deploy delegate role template with empty DatadogIntegrationRoleName — verify graceful skip
• Deploy delegate role template with populated DatadogIntegrationRoleName — verify attachment
• Re-deploy when SecurityAudit is already attached — verify idempotency (no errors)

🤖 Generated with Claude Code

[ksirrah13]

❓Question(non-blocking): Is there any kind of clean up needed during delete for this policy and attachment? Thinking that may have unexpected consequences like removing the security audit policy when it was added by another service, but just wanted to clarify the expected behavior on delete and if the lingering policy would be a problem.

[k3nz0]

Question(non-blocking): Is there any kind of clean up needed during delete for this policy and attachment? Thinking that may have unexpected consequences like removing the security audit policy when it was added by another service, but just wanted to clarify the expected behavior on delete and if the lingering policy would be a problem.

Not really. I don't think we'll need clean-ups. The Security Audit policy is AWS managed and attached. Our lambda just attaches it to the Datadog Integration role if it's missing.