chore(ec2): extract grant logic to a helper class

[otaviomacedo]

Move the logic from VolumeBase.grantAttachVolumeByResourceTag() and VolumeBase.grantAttachVolume() to a new helper class, called VolumeGrants. With this, we can give grants to L1s and L2s in a uniform way:

const instance = new Instance(stack, 'Instance', ...);

// Basic usage:
const volume = new CfnVolume(stack, 'Volume', {
  availabilityZone: 'us-east-1a',
});

VolumeGrants.fromVolume(volume).grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance]);

If the instance of IVolumeRef that we have also happens to implement IResourceWithKey, we can do:

const volume = new Volume(stack, 'Volume', {
  availabilityZone: 'us-east-1a',
});

VolumeGrants.fromVolumeWithKey(volume).grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance]);
//                ^----- Different factory method

which will also give the grantee permission to kms:CreateGrant on the encryption key, if one is defined.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[otaviomacedo]

Better naming suggestions are welcome.

[rix0rrr]

IEncryptedResource ?

IEncryptableResource ?

[rix0rrr]

No intersections yet please :)

[rix0rrr]

(May just mean we need to wait a bit before merging this)

[otaviomacedo]

Marked with do-not-merge.

[rix0rrr]

IEncryptedResource ?

IEncryptableResource ?

[rix0rrr]

addToKeyPolicy() ? With a Statement ?

(Although I guess that's not entirely the thing, is it...)

[otaviomacedo]

Yeah, that would be better. The only question is: a PolicyStatement may have many principals. Should we grant the permission to all of them?