Repository: getmoto/moto

Issue:
Trust policy validation missing sts:TagSession action
Moto version: 3.1.18
using Python mocks
boto3 version: 1.17.112
botocore version: 1.20.112

Missing **`sts:TagSession`** as allowed action in Trust policy validation https://github.com/spulec/moto/blob/master/moto/iam/policy_validation.py#L566
Using it per this [AWS document](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_permissions-required) and noticed my tests started failing after this validation was added.

Issue can be reproduced by adding that action to list of allowed action when testing update_assume_role_policy command.
The test fails with `MalformedPolicyDocumentException` and when I do it live it works normally.

I think this **`sts:TagSession`** should be added to the list of viable actions.

Error:
```
___________________________ test_update_trust_policy ___________________________

    @mock_iam
    def test_update_trust_policy():
        """
        Test update trust policy
        :return:
        """
        client = boto3.client('iam')
        role = create_iam_stuff(client)
        request = \
            UpdatePolicyRequest(
                **{
                    'policy': {
                        'Version': '2012-10-17',
                        'Statement': [
                            {
                                'Effect': 'Allow',
                                'Principal': {
                                    'AWS': [
                                        "arn:aws:iam::123456789012:user/user1",
                                        "arn:aws:iam::123456789012:role/role1"
                                    ]
                                },
                                'Action': ['sts:AssumeRole', 'sts:TagSession']
                            }
                        ]
                    }
                }
            )
        with patch('app.aws.iam.service.clients.get_boto_client') as mock_boto:
            mock_boto.return_value = client
>           response = service.update_trust_policy(tenant='tenant',
                                                   profile='profile',
                                                   role_name=role['Role']['RoleName'],
                                                   request=request)

test/aws/iam/test_service.py:167: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
app/aws/iam/service.py:176: in update_trust_policy
    response = client.update_assume_role_policy(
env/lib/python3.10/site-packages/botocore/client.py:386: in _api_call
    return self._make_api_call(operation_name, kwargs)
env/lib/python3.10/site-packages/epsagon/modules/botocore.py:31: in _wrapper
    return wrapper(BotocoreEventFactory, wrapped, instance, args, kwargs)
env/lib/python3.10/site-packages/epsagon/modules/general_wrapper.py:28: in wrapper
    response = wrapped(*args, **kwargs)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <botocore.client.IAM object at 0x7f008d747220>
operation_name = 'UpdateAssumeRolePolicy'
api_params = {'PolicyDocument': '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": ["arn:aws:iam::123456789012:role/role1"]}, "Action": ["sts:AssumeRole", "sts:TagSession"]}]}', 'RoleName': 'test-role'}

    def _make_api_call(self, operation_name, api_params):
        operation_model = self._service_model.operation_model(operation_name)
        service_name = self._service_model.service_name
        history_recorder.record('API_CALL', {
            'service': service_name,
            'operation': operation_name,
            'params': api_params,
        })
        if operation_model.deprecated:
            logger.debug('Warning: %s.%s() is deprecated',
                         service_name, operation_name)
        request_context = {
            'client_region': self.meta.region_name,
            'client_config': self.meta.config,
            'has_streaming_input': operation_model.has_streaming_input,
            'auth_type': operation_model.auth_type,
        }
        request_dict = self._convert_to_request_dict(
            api_params, operation_model, context=request_context)
    
        service_id = self._service_model.service_id.hyphenize()
        handler, event_response = self.meta.events.emit_until_response(
            'before-call.{service_id}.{operation_name}'.format(
                service_id=service_id,
                operation_name=operation_name),
            model=operation_model, params=request_dict,
            request_signer=self._request_signer, context=request_context)
    
        if event_response is not None:
            http, parsed_response = event_response
        else:
            http, parsed_response = self._make_request(
                operation_model, request_dict, request_context)
    
        self.meta.events.emit(
            'after-call.{service_id}.{operation_name}'.format(
                service_id=service_id,
                operation_name=operation_name),
            http_response=http, parsed=parsed_response,
            model=operation_model, context=request_context
        )
    
        if http.status_code >= 300:
            error_code = parsed_response.get("Error", {}).get("Code")
            error_class = self.exceptions.from_code(error_code)
>           raise error_class(parsed_response, operation_name)
E           botocore.errorfactory.MalformedPolicyDocumentException: An error occurred (MalformedPolicyDocument) when calling the UpdateAssumeRolePolicy operation: Trust Policy statement actions can only be sts:AssumeRole, sts:AssumeRoleWithSAML,  and sts:AssumeRoleWithWebIdentity

env/lib/python3.10/site-packages/botocore/client.py:705: MalformedPolicyDocumentException
```


Discussion:
Thanks for raising this @zumic96! Marking it as a bug

Resolving patch:
diff --git a/moto/iam/policy_validation.py b/moto/iam/policy_validation.py
--- a/moto/iam/policy_validation.py
+++ b/moto/iam/policy_validation.py
@@ -568,4 +568,5 @@ def _validate_trust_policy_action(action):
             "sts:AssumeRole",
             "sts:AssumeRoleWithSAML",
             "sts:AssumeRoleWithWebIdentity",
+            "sts:TagSession",
         )


Test patch: