fix: use static ARNs in attached_policies to avoid for_each unknown v…

…alue error

Terraform cannot use compute-time resource ARNs (aws_iam_policy.*.arn) as
for_each set keys since they are unknown at plan time. Replace with statically
constructed ARNs using locals that are always known at plan time:
  format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.<name>)

Fixes 'Invalid for_each argument' errors on all three role modules.

roles.tf

@@ -5,7 +5,7 @@ module "patch_role" {
   role_name              = local.patch_role_name
   role_description       = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json
-  attached_policies      = [aws_iam_policy.patch_role.arn]
+  attached_policies      = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_policy_name)]
 
   tags = local.tags_iam
 }
@@ -17,7 +17,7 @@ module "patch_execution_role" {
   role_name              = local.patch_execution_role_name
   role_description       = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json
-  attached_policies      = [aws_iam_policy.patch_execution_role.arn]
+  attached_policies      = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execution_policy_name)]
 
   tags = local.tags_iam
 }
@@ -31,7 +31,7 @@ module "patch_execproxy_role" {
   role_name               = local.patch_execproxy_role_name
   role_description        = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name)
   assume_policy_document  = data.aws_iam_policy_document.patch_execproxy_role_assume.json
-  attached_policies       = [aws_iam_policy.patch_execproxy_role.arn]
+  attached_policies       = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execproxy_policy_name)]
   enable_instance_profile = true
 
   tags = local.tags_iam