Tokens service access key requirement removed - EUCA-4874

The tokens service no longer requires a user to have an access key when
they authenticated using account/user name and password credentials.

In this case the encrypted token refers to the user id to allow look up
of the credential download token for a user (instead of a secret key)

EUCA-4874
IAM roles crud and partial implementation of STS assume role - EUCA-5250

Support is added for IAM roles and a partial STS implementation of
issuing credentials for assuming roles.

Euare and token service bindings and PolicySpec are updated to support
the new operations. EuareService is updated with implementations for
role operation and stubs for instance profile operations.

Role, RoleEntity and DatabaseRoleProxy are added for role support.
Account and Privileged are updated with support for roles. RoleUser is
added for use when invoking operations with an assumed role.

TokensService and SecurityTokenManager are updated with a partial
implementation of the assume role operation. Roles can be assumed but
assume role policies are not currently supported/enforced.

Ern is updated to support ARNs for roles. RoleNumberQuotaKey is added to
support quotas for roles.

The EuareReplyQueue and EuareException are moved to the euare module for
improved modularity.

Account is updated to allow lookup of the admin user. Lookup of the
admin user by name is replaced with the new method where appropriate.

EUCA-5250
IAM / STS changes for assume role support - EUCA-5250

IAM policy support is added for policies attached to resources,
previously only policies attached to identities were supported. Resource
attached policies must specify a Princial/NotPrincipal. Policy parsing
now requires that the user specify the expected attachment type for
validation purposes.

Principal, PrincipalEntity, and DatabasePrincipalProxy are added for
principal support with policies. StatementEntity is updated to reference
the contained principal.

The policy engine and Permissions are updated to support evaluation of
resource attached policies and to allow inter-account resource denials.

A new RestrictedIdentity utility class is added along the lines of
RestrictedTypes but supporting resource attached policies.

PolicySpec now supports canonicalization of resource names which may or
may not be case sensitive depending on the vendor.

The DatabasePolicyProxy now support access to the authorizations for a
policy.

The TokensService is updated to enforce assume role policies.

Accounts now exposes utility methods for identity ARN construction.

EUCA-5250
STS assume role external ID support - EUCA-5250

Assume role policies now support use of an external ID. When an external
ID is available it is stored using ExternalIdContext, evaluation of the
policy key ExternalIdKey will use the contextual value.

EUCA-5250
IAM instance profile support - EUCA-5250

Support is added for IAM instance profile CRUD including assignment of
roles to instance profiles.

An InstanceProfileEntity is added for persistence along with a related
InstanceProfile interface and DatabaseInstanceProfileProxy
implementation.

EuareService and Privileged are updated to support the instance profile
operations.

Roles and Accounts are updated to allow listing of related instance
profiles.

Instance profile related messages and bindings are updated to support
the custom account delegation parameter.

An InstanceProfileNumberQuotaKey is added for support of instance
profile quotas.

Prinipals is updated to clean up the implementation of system accounts.

EUCA-5250
Merge IAM roles changes to team/clc-dev/services
IAM policy evaluation cleanup for resource policies - EUCA-5250

RestrictedIdentity is removed, the functionality provided by this class
is now in RestrictedTypes. The policy for a resource can now be accessed
from that resource (RestrictedType).

The TokensService is updated to use RestrictedTypes.

EUCA-5250
EC2 RunInstances command ClientToken support - EUCA-5346

RunInstances now accepts a ClientToken to support idempotency. While
instances are running or in the terminated cache we will not launch new
instances when the client token is reused (per account)

EUCA-5346
Auto scaling group administrative launch suspension support - EUCA-5399

The launch process is now suspended automatically for an auto scaling
group that has been failing to launch instances for over 24 hours. The
SuspendProcesses action will now put a process into administrative
suspension when the cloud administrator suspends a process for another
account.

EUCA-5399
Auto scaling filtering support for DescribeTags - EUCA-5137

The auto scaling DescribeTags operation now supports the Filters option
for limiting the returned tags.

EUCA-5137
initial commit for AZ support for ELB
EUCA-4922: multiple zone support when loadbalancer is created
  -- a servo vm will be launched per zone
  -- backend instances in a zone will be served by the servo vm in the same zone
Auto scaling parameter validation support - EUCA-5016

Added AutoScalingMessageValidation with annotations and utility methods
that support message validation. A new AutoScalingMessageValidator
component is added that is invoked prior to service methods to perform
message validation. Auto scaling messages are now annotated for
validation.

AutoScalingService is updated to perform more validation (e.g. across
multiple fields)

A new ValidationErrorException is added for use on validation failures.

EUCA-5016
Filter by owner when listing instances - EUCA-1509

RestrictedTypes now exposes Predicates for filtering by account and/or
user. VmInstances uses the new predicates when listing instances.

EUCA-1509
Auto scaling instance profile support - EUCA-5351

Creation of instance profiles now validates the IAM instance profile
name or ARN. ActivityManager is updated to validate the referenced
instance profile.

LaunchConfiguration is updated to persist the instance profile. The
instance profile is now included when describing launch configurations.

The instance profile name or ARN is passed when launching instances.

IAM is updated to allow instance profile ARNs, and also to list instance
profiles in the account summary.

EUCA-5351
EUCA-5374 Able to call auto scale actions (execute policy) from cloudwatch alarms.
Auto scaling alarms in DescribePolicies response - EUCA-5465

Auto scaling now calls out to CloudWatch to determine the alarms that
are linked to scaling policies.

The AutoScalingService is updated to use ActivityManager for look up of
alarm ARNs. The service populates the response message with the alarm
information.

ActivityManager has new a process/activity for resovling alarm ARNs from
policy ARNs.

A CloudWatchClient is added for CloudWatch messages.

EUCA-5465
EUCA-5371: enabling round-robin dns for loadbalancers with more than one VMs
    -- add CRUD operations to the DNS service so that it allows creating a name and adding/removing ip addresses to it
    -- change ELB service to use the created CRUD operations of the DNS service
    -- add fireThrowableEvent to the ListenerRegistry; LoadBalancer use the method to get notified the exception situation immediately
Auto scaling add handling for unsupported options - EUCA-5200

Use of a placement group or VPC zone identifier with an auto scaling
group will now result in a ValidationError.

Spot prices are accepted and validated but ignored.

EUCA-5200
EUCA-5702 implemented database purge for cloudwatch (metric_data, list_metrics and alarm_history are purged once a day for data older than two weeks)