Re-visit how we apply the AmazonSSMManagedInstanceCore in the ec2-instance and ec2-autoscaling-group modules

[richgreen-moj]

User Story

As a user of the modules
I want to use the latest versions of the ec2-autoscaling-group and ec2-instance modules v3.0.0, which remediates a deprecation in the way polices are attached to roles
So that the update can be made as smoothly as possible and there is no significant impact to multiple workloads currently using the module

Value / Purpose

v3.0.0 for these modules were released earlier this year to fix a deprecation in the way that policies are attached to roles. @robertsweetman has been attempting to use this to update multiple workloads that are dependant on the module but is finding that with the current implementation , our attempts to force use of the AmazonSSMManagedInstanceCore policy are causing a duplication on a Terraform plan as they are already passing in AmazonSSMManagedInstanceCore using the modules var.instance_profile_policies variable.

In v2.5.0 of the ec2-instance module and v2.6.0 of the ec2-autoscaling-group modules we made changes so that the AmazonSSMManagedInstanceCore policy was always applied regardless of whether the user specifies it. This was part of #7412 to ensure all MP instances are connected to SSM where possible by default.

There is a suggestion from @drobinson-moj here which we could use where the SSM policy is just used as a default value to the variable. We should consider if this is the best way forward being that this is the main userbase of these modules and they are going to pass in the policy anyway.

Context / Background

https://mojdt.slack.com/archives/C01A7QK5VM1/p1733488497868419 << this Slack thread documents the discussion and everything that has taken place so far.

Note some of the options I documented here

Useful Contacts

No response

Additional Information

No response

Definition of Done

• Review approaches and discuss with team to agree best approach
• Implement and test approach in coordination with @robertsweetman

[markgov]

Talked with rich about this agreed to bring it up after stand up tomorrow

[markgov]

After talking with the team i have decided to add a boolen to allow users to skip adding the ssm policy see
ministryofjustice/modernisation-platform-terraform-ec2-autoscaling-group#536